Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1498716
MD5:26e9a7949cc17782f6595ea8cc61cc51
SHA1:4af94b27f3644e20deb5e439346d72ef1c634ddf
SHA256:c3e67343b828fb0867a816f099b4363539fe3d350857d015613549533d5a26fd
Tags:exe
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Maps a DLL or memory area into another process
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 26E9A7949CC17782F6595EA8CC61CC51)
    • msedge.exe (PID: 3512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 6616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2076,i,9262140819210308116,14005196372618419780,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • firefox.exe (PID: 3492 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 764 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 6352 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8204 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a9f113-9e6d-45ad-ab60-94915a598ad8} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28243d6e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8964 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2966af3d-95c8-4906-bee5-aa169991a07c} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28255bf0110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • msedge.exe (PID: 7188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6588 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8424 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 8964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • identity_helper.exe (PID: 8992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • msedge.exe (PID: 4852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6684 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 2188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 3320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2032,i,14870212226961383276,9342203305708835618,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 8532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2052,i,4253546098503553412,11041898619462647217,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeVirustotal: Detection: 18%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exeJoe Sandbox ML: detected
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00DCDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD68EE FindFirstFileW,FindClose,0_2_00DD68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00DD698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DCD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DCD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DD9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DD979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00DD9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00DD5C97
Source: firefox.exeMemory has grown: Private usage: 1MB later: 96MB
Source: global trafficTCP traffic: 192.168.2.4:49751 -> 1.1.1.1:53
Source: Joe Sandbox ViewIP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.132
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.176.206
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DDCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_00DDCE44
Source: global trafficHTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDoZ+7e+4bO81aT&MD=hDGSuHOy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725210726&P2=404&P3=2&P4=O77p0UKOKArWtpGMuwvQZVcIk%2fk1DA7Ji59HimrrcvrA145rkHawl4xLUZLKsyR8JOxnnZQNbjqnKgYFdt8OTw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Ck6usvdY9iORV35Ia1offtSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDoZ+7e+4bO81aT&MD=hDGSuHOy HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Wikipedia&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Reddit&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;Twitter&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1775544242.00000282554E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039404799.00000282554E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1775544242.00000282554E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2039404799.00000282554E3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2034804367.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1763594649.00000282547DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: example.org
Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
Source: global trafficDNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: firefox.exe, 00000004.00000003.1866682576.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1915549706.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2040070374.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035608079.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2338266503.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000004.00000003.2045153090.0000028254132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2037270745.0000028251280000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org
Source: firefox.exe, 00000004.00000003.2045153090.0000028254132000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-aarch64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zi
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-arm-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86_64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2040070374.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035608079.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2338266503.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2038570670.0000028255427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312282189.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759314.0000028250C80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000004.00000003.2338470485.000002824FDBC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000004.00000003.2045916950.000002824FDD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1828923703.0000028254630000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000004.00000003.2035839809.0000028253A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000004.00000003.1864790749.000002825412A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000004.00000003.2312586154.00000282512F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042352471.00000282512F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867679424.00000282512F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.comD
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000004.00000003.1918054767.000002824F326000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000004.00000003.1918054767.000002824F381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000004.00000003.1918054767.000002824F326000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000004.00000003.1918054767.000002824F381000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000004.00000003.1918054767.000002824F326000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000004.00000003.1857460428.0000028251672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1773201996.0000028256DAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1743466064.0000028253DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864034209.0000028255D60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1915513621.0000028253BA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2041848582.0000028255C88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1863601457.0000028255DEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1866039130.0000028253DF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1850639289.0000028253DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860988677.0000028256392000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1866629158.0000028253B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1856457335.000002850003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1737402443.0000028254273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867612498.0000028251E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1743466064.0000028253DF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860259245.00000282563E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2364849954.00000282519F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1853180016.00000282519F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867339086.0000028253463000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759314.0000028250C80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000004.00000003.2316157115.000002824FC3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.agfamonotype.
Source: firefox.exe, 00000004.00000003.2405866958.0000028255058000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
Source: firefox.exe, 00000004.00000003.2312053810.000002824FC35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2311966204.000002824FC35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2311885551.000002824FC35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
Source: firefox.exe, 00000004.00000003.2311885551.000002824FC35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2322994484.000002824FC3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: firefox.exe, 00000004.00000003.2313824469.000002824FC39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers)
Source: firefox.exe, 00000004.00000003.2313824469.000002824FC39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
Source: firefox.exe, 00000004.00000003.2322994484.000002824FC3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersHrkt
Source: firefox.exe, 00000004.00000003.2322994484.000002824FC3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designerss
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000004.00000003.2424520445.000002824FC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: firefox.exe, 00000004.00000003.2424202810.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2426015291.000002824FC2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424520445.000002824FC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/.TTC
Source: firefox.exe, 00000004.00000003.2424202810.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2423604180.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2421550161.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424520445.000002824FC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/F
Source: firefox.exe, 00000004.00000003.2430312519.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424202810.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2423604180.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2426015291.000002824FC2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2421550161.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2427825738.000002824FC2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424520445.000002824FC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: firefox.exe, 00000004.00000003.2426015291.000002824FC2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/xH
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759314.0000028250C80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000004.00000003.2035361775.0000028254164000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312229786.0000028253B18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000004.00000003.1863783564.0000028255DB6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000004.00000003.2313469405.000002824FC33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2313534710.000002824FC34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2313595890.000002824FC35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: firefox.exe, 00000004.00000003.2405866958.0000028255058000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
Source: firefox.exe, 00000004.00000003.2319016590.000002824FC34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2317607445.000002824FC34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.typography.net
Source: firefox.exe, 00000004.00000003.2405866958.0000028255058000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
Source: firefox.exe, 00000010.00000003.1774265737.000001C06DC6C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2918075470.000001C06DC6C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1763744176.000001C06DC6C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1760749653.000001C06DC6C000.00000004.00000020.00020000.00000000.sdmp, mozilla-temp-41.4.drString found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000004.00000003.1863601457.0000028255DC1000.00000004.00000800.00020000.00000000.sdmp, Session_13369079523762195.7.drString found in binary or memory: https://accounts.google.com
Source: 000003.log3.7.dr, Session_13369079523762195.7.drString found in binary or memory: https://accounts.google.com/
Source: History.7.dr, Favicons.7.drString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/v3/signin/challeng
Source: firefox.exe, 0000000A.00000002.2914105861.000002047156A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?seh
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.co
Source: Session_13369079523762195.7.drString found in binary or memory: https://accounts.google.com/_/bscframe
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/favicon.ico
Source: file.exe, 00000000.00000003.1652552912.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1653166471.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000002.1659439556.000001E2DCB42000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000003.1655722164.000001E2DCB3D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: file.exe, 00000000.00000003.1652552912.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1653166471.0000000000FA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd::
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fs
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2034804367.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1763594649.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1775544242.000002825544C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://amazon.com
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000004.00000003.2338470485.000002824FDBC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000004.00000003.2338470485.000002824FDBC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000004.00000003.2318824652.000002824FD08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2312910405.000002824FD08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000004.00000003.1867339086.00000282534BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: Reporting and NEL.7.drString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.7.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.7.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.7.drString found in binary or memory: https://chromewebstore.google.com/
Source: 01538245-1a26-4ce6-86f0-88bc97929155.tmp.8.drString found in binary or memory: https://clients2.google.com
Source: manifest.json.7.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: manifest.json.7.drString found in binary or memory: https://docs.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.7.drString found in binary or memory: https://drive.google.com/
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864790749.000002825412A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2318522102.000002825412A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: 000003.log.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 000003.log.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/SelectOptionsLengthAssignmentW
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000004.00000003.2312882793.000002824FDA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000004.00000003.2338470485.000002824FDBC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000004.00000003.2318629722.000002824FDE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916623740.0000028250C3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000004.00000003.1863812436.0000028255DA1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
Source: firefox.exe, 00000004.00000003.1863601457.0000028255DFC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.4.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000004.00000003.2312712717.000002824FDD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000004.00000003.2312910405.000002824FD08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2318355133.0000028254796000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000004.00000003.2338470485.000002824FDBC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000004.00000003.2318629722.000002824FDE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.comZ
Source: firefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859993863.00000282563EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000000A.00000002.2914602955.0000020471872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D492000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000000A.00000002.2914602955.0000020471872000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916777182.000002824FDE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868373508.000002824FDE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000004.00000003.2037240163.0000028251288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000004.00000003.2045153090.0000028254132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000004.00000003.2045153090.0000028254132000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000004.00000003.2045326693.0000028251E65000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864790749.000002825412A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000004.00000003.2318629722.000002824FDE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000004.00000003.2035361775.000002825415E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000004.00000003.1828766313.0000028254686000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035317478.0000028254676000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044945268.0000028254676000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000004.00000003.1828766313.0000028254686000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035317478.0000028254676000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044945268.0000028254676000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2034804367.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1763594649.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1775544242.000002825544C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000004.00000003.1763088976.0000028255F83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000004.00000003.2045029150.0000028254164000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045153090.0000028254132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035361775.0000028254164000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1828923703.0000028254630000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000004.00000003.1867339086.00000282534BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: content_new.js.7.dr, content.js.7.drString found in binary or memory: https://www.google.com/chrome
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: Web Data.7.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1828923703.0000028254630000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916623740.0000028250C3B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000004.00000003.1918054767.000002824F35F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/)
Source: firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867339086.00000282534B6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.comZ
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/Office
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.tsn.caZ
Source: firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.48:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DDEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00DDEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DDED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00DDED6A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DDEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00DDEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_00DCAA57
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DF9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00DF9576

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_374e5d2f-9
Source: file.exe, 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_4b8a9ddb-4
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_66d15dfd-5
Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_2b162be4-5
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB28AB7 NtQuerySystemInformation,16_2_000001C06DB28AB7
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB59C72 NtQuerySystemInformation,16_2_000001C06DB59C72
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_00DCD5EB
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00DC1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00DCE8F6
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D6BF400_2_00D6BF40
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD20460_2_00DD2046
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D680600_2_00D68060
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC82980_2_00DC8298
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D9E4FF0_2_00D9E4FF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D9676B0_2_00D9676B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DF48730_2_00DF4873
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D6CAF00_2_00D6CAF0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D8CAA00_2_00D8CAA0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D7CC390_2_00D7CC39
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D96DD90_2_00D96DD9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D691C00_2_00D691C0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D7B1190_2_00D7B119
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D813940_2_00D81394
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D817060_2_00D81706
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D8781B0_2_00D8781B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D819B00_2_00D819B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D7997D0_2_00D7997D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D679200_2_00D67920
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D87A4A0_2_00D87A4A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D87CA70_2_00D87CA7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D81C770_2_00D81C77
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D99EEE0_2_00D99EEE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DEBE440_2_00DEBE44
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D81F320_2_00D81F32
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB28AB716_2_000001C06DB28AB7
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB59C7216_2_000001C06DB59C72
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB59CB216_2_000001C06DB59CB2
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB5A39C16_2_000001C06DB5A39C
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00D7F9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00D80A30 appears 46 times
Source: file.exe, 00000000.00000002.1653259925.0000000000FE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefirefox.exe vs file.exe
Source: file.exe, 00000000.00000003.1652552912.0000000000FE3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefirefox.exe vs file.exe
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engineClassification label: mal68.evad.winEXE@72/331@26/20
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD37B5 GetLastError,FormatMessageW,0_2_00DD37B5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC10BF AdjustTokenPrivileges,CloseHandle,0_2_00DC10BF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00DC16C3
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00DD51CD
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,0_2_00DCD4DC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_00DD648E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00D642A2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CB65DE-DB8.pmaJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Temp\firefoxJump to behavior
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Login Data.7.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exeVirustotal: Detection: 18%
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2076,i,9262140819210308116,14005196372618419780,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a9f113-9e6d-45ad-ab60-94915a598ad8} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28243d6e510 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6588 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2966af3d-95c8-4906-bee5-aa169991a07c} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28255bf0110 rdd
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2032,i,14870212226961383276,9342203305708835618,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2052,i,4253546098503553412,11041898619462647217,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6684 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2076,i,9262140819210308116,14005196372618419780,262144 /prefetch:3Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a9f113-9e6d-45ad-ab60-94915a598ad8} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28243d6e510 socketJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6588 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6684 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2032,i,14870212226961383276,9342203305708835618,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2052,i,4253546098503553412,11041898619462647217,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D642DE
Source: gmpopenh264.dll.tmp.4.drStatic PE information: section name: .rodata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D80A76 push ecx; ret 0_2_00D80A89
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D7F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00D7F98E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DF1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00DF1C41
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-96684
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB28AB7 rdtsc 16_2_000001C06DB28AB7
Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.3 %
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00DCDBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD68EE FindFirstFileW,FindClose,0_2_00DD68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00DD698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DCD076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00DCD3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DD9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00DD979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00DD9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00DD5C97
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D642DE
Source: firefox.exe, 00000010.00000002.2912656896.000001C06D1FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
Source: firefox.exe, 00000010.00000002.2916556447.000001C06DA00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllR
Source: firefox.exe, 0000000A.00000002.2914105861.000002047156A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2916556447.000001C06DA00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: firefox.exe, 0000000A.00000002.2918077913.0000020471B00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: firefox.exe, 0000000A.00000002.2917441363.0000020471A13000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000000A.00000002.2918077913.0000020471B00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: firefox.exe, 0000000A.00000002.2914105861.000002047156A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
Source: firefox.exe, 00000010.00000002.2916556447.000001C06DA00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001C06DB28AB7 rdtsc 16_2_000001C06DB28AB7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DDEAA2 BlockInput,0_2_00DDEAA2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D92622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D642DE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D84CE8 mov eax, dword ptr fs:[00000030h]0_2_00D84CE8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00DC0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D92622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D8083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D8083F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D809D5 SetUnhandledExceptionFilter,0_2_00D809D5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D80C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00D80C21

HIPS / PFW / Operating System Protection Evasion

barindex
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonlyJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00DC1201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DA2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00DA2BA5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DCB226 SendInput,keybd_event,0_2_00DCB226
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DE22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_00DE22DA
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00DC0B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DC1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00DC1663
Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exeBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D80698 cpuid 0_2_00D80698
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DD8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00DD8195
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DBD27A GetUserNameW,0_2_00DBD27A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D9BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00D9BB6F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00D642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D642DE
Source: file.exeBinary or memory string: WIN_81
Source: file.exeBinary or memory string: WIN_XP
Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exeBinary or memory string: WIN_XPe
Source: file.exeBinary or memory string: WIN_VISTA
Source: file.exeBinary or memory string: WIN_7
Source: file.exeBinary or memory string: WIN_8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DE1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00DE1204
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00DE1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00DE1806

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Valid Accounts		1
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		2
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job2
Valid Accounts		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Extra Window Memory Injection		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
Valid Accounts		1
DLL Side-Loading		NTDS15
System Information Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
Access Token Manipulation		1
Extra Window Memory Injection		LSA Secrets131
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts112
Process Injection		1
Masquerading		Cached Domain Credentials1
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Registry Run Keys / Startup Folder		2
Valid Accounts		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Virtualization/Sandbox Evasion		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
Access Token Manipulation		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron112
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1498716 Sample: file.exe Startdate: 25/08/2024 Architecture: WINDOWS Score: 68 48 telemetry-incoming.r53-2.services.mozilla.com 2->48 50 sni1gl.wpc.nucdn.net 2->50 52 13 other IPs or domains 2->52 70 Multi AV Scanner detection for submitted file 2->70 72 Binary is likely a compiled AutoIt script file 2->72 74 Machine Learning detection for sample 2->74 76 AI detected suspicious sample 2->76 8 file.exe 1 2->8         started        11 msedge.exe 34 520 2->11         started        14 firefox.exe 1 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 78 Binary is likely a compiled AutoIt script file 8->78 80 Found API chain indicative of sandbox detection 8->80 18 msedge.exe 16 8->18         started        20 firefox.exe 1 8->20         started        66 192.168.2.4, 138, 443, 49309 unknown unknown 11->66 68 239.255.255.250 unknown Reserved 11->68 82 Maps a DLL or memory area into another process 11->82 22 msedge.exe 11->22         started        25 msedge.exe 11->25         started        27 msedge.exe 11->27         started        36 3 other processes 11->36 29 firefox.exe 3 95 14->29         started        32 msedge.exe 16->32         started        34 msedge.exe 16->34         started        signatures6 process7 dnsIp8 38 msedge.exe 18->38         started        54 s-part-0039.t-0009.t-msedge.net 13.107.246.67, 443, 49764, 49765 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->54 56 142.250.176.206, 443, 49770, 49771 GOOGLEUS United States 22->56 62 13 other IPs or domains 22->62 58 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49774, 49778, 49797 GOOGLEUS United States 29->58 60 telemetry-incoming.r53-2.services.mozilla.com 34.120.208.123, 443, 49805, 49806 GOOGLEUS United States 29->60 64 5 other IPs or domains 29->64 44 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 29->44 dropped 46 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 29->46 dropped 40 firefox.exe 29->40         started        42 firefox.exe 29->42         started        file9 process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe19%VirustotalBrowse
file.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
example.org0%VirustotalBrowse
chrome.cloudflare-dns.com0%VirustotalBrowse
prod.detectportal.prod.cloudops.mozgcp.net0%VirustotalBrowse
services.addons.mozilla.org0%VirustotalBrowse
prod.classify-client.prod.webservices.mozgcp.net0%VirustotalBrowse
prod.balrog.prod.cloudops.mozgcp.net0%VirustotalBrowse
ipv4only.arpa0%VirustotalBrowse
prod.remote-settings.prod.webservices.mozgcp.net0%VirustotalBrowse
s-part-0039.t-0009.t-msedge.net0%VirustotalBrowse
bzib.nelreports.net0%VirustotalBrowse
firefox.settings.services.mozilla.com0%VirustotalBrowse
detectportal.firefox.com0%VirustotalBrowse
sni1gl.wpc.nucdn.net0%VirustotalBrowse
telemetry-incoming.r53-2.services.mozilla.com0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l0%URL Reputationsafe
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l0%URL Reputationsafe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%0%URL Reputationsafe
http://www.mozilla.com00%URL Reputationsafe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.0%URL Reputationsafe
https://merino.services.mozilla.com/api/v1/suggest0%URL Reputationsafe
http://www.fontbureau.com/designers0%URL Reputationsafe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect0%URL Reputationsafe
https://screenshots.firefox.com0%URL Reputationsafe
https://completion.amazon.com/search/complete?q=0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report0%URL Reputationsafe
https://ads.stickyadstv.com/firefox-etp0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab0%URL Reputationsafe
https://monitor.firefox.com/breach-details/0%URL Reputationsafe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM0%URL Reputationsafe
https://xhr.spec.whatwg.org/#sync-warning0%URL Reputationsafe
https://profiler.firefox.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/addon/0%URL Reputationsafe
https://tracking-protection-issues.herokuapp.com/new0%URL Reputationsafe
http://exslt.org/sets0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report0%URL Reputationsafe
https://api.accounts.firefox.com/v10%URL Reputationsafe
http://exslt.org/common0%URL Reputationsafe
https://drive-daily-2.corp.google.com/0%URL Reputationsafe
https://fpn.firefox.com0%URL Reputationsafe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc0%URL Reputationsafe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections0%URL Reputationsafe
https://drive-daily-1.corp.google.com/0%URL Reputationsafe
https://drive-daily-5.corp.google.com/0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield0%URL Reputationsafe
http://www.carterandcone.coml0%URL Reputationsafe
https://bzib.nelreports.net/api/report?cat=bingbusiness0%URL Reputationsafe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=0%URL Reputationsafe
https://bugzilla.mo0%URL Reputationsafe
https://mitmdetection.services.mozilla.com/0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%Avira URL Cloudsafe
https://drive-preprod.corp.google.com/0%URL Reputationsafe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%0%URL Reputationsafe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f0%URL Reputationsafe
https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
https://www.msn.comZ0%Avira URL Cloudsafe
https://monitor.firefox.com/user/breach-stats?includeResolved=true0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report0%URL Reputationsafe
https://services.addons.mozilla.org0%Avira URL Cloudsafe
https://merino.services.mozilla.com/api/v1/suggestabout0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-0%URL Reputationsafe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=0%URL Reputationsafe
https://monitor.firefox.com/user/dashboard0%URL Reputationsafe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID0%URL Reputationsafe
https://monitor.firefox.com/about0%URL Reputationsafe
https://account.bellmedia.c0%URL Reputationsafe
https://login.microsoftonline.com0%URL Reputationsafe
https://coverage.mozilla.org0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
https://blocked.cdn.mozilla.net/0%URL Reputationsafe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener0%URL Reputationsafe
https://profiler.firefox.com0%URL Reputationsafe
https://outlook.live.com/default.aspx?rru=compose&to=%s0%URL Reputationsafe
https://mozilla.cloudflare-dns.com/dns-query0%URL Reputationsafe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg0%URL Reputationsafe
https://contile.services.mozilla.com/v1/tiles0%URL Reputationsafe
https://monitor.firefox.com/user/preferences0%URL Reputationsafe
https://screenshots.firefox.com/0%URL Reputationsafe
https://relay.firefox.com/api/v1/0%URL Reputationsafe
https://drive-autopush.corp.google.com/0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report0%URL Reputationsafe
https://topsites.services.mozilla.com/cid/0%URL Reputationsafe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr0%URL Reputationsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%Avira URL Cloudsafe
https://docs.google.com/0%Avira URL Cloudsafe
https://duckduckgo.com/chrome_newtab0%VirustotalBrowse
https://services.addons.mozilla.org0%VirustotalBrowse
https://www.amazon.com/exec/obidos/external-search/0%Avira URL Cloudsafe
https://duckduckgo.com/ac/?q=0%VirustotalBrowse
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%VirustotalBrowse
https://docs.google.com/0%VirustotalBrowse
https://www.amazon.com/exec/obidos/external-search/0%VirustotalBrowse
https://github.com/mozilla-services/screenshots0%Avira URL Cloudsafe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc940%Avira URL Cloudsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%VirustotalBrowse
https://www.msn.com0%Avira URL Cloudsafe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%Avira URL Cloudsafe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta0%Avira URL Cloudsafe
https://www.youtube.com/0%Avira URL Cloudsafe
https://www.google.com/favicon.ico0%Avira URL Cloudsafe
https://github.com/mozilla-services/screenshots0%VirustotalBrowse
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%VirustotalBrowse
http://127.0.0.1:0%Avira URL Cloudsafe
https://amazon.com0%Avira URL Cloudsafe
https://chrome.google.com/webstore/0%Avira URL Cloudsafe
https://www.msn.com0%VirustotalBrowse
https://www.youtube.com/0%VirustotalBrowse
http://detectportal.firefox.comD0%Avira URL Cloudsafe
https://amazon.com0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
example.org
93.184.215.14
truefalseunknown
chrome.cloudflare-dns.com
162.159.61.3
truefalseunknown
prod.classify-client.prod.webservices.mozgcp.net
35.190.72.216
truefalseunknown
prod.balrog.prod.cloudops.mozgcp.net
35.244.181.201
truefalseunknown
prod.detectportal.prod.cloudops.mozgcp.net
34.107.221.82
truefalseunknown
services.addons.mozilla.org
52.222.236.48
truefalseunknown
ipv4only.arpa
192.0.0.171
truefalseunknown
s-part-0039.t-0009.t-msedge.net
13.107.246.67
truefalseunknown
prod.remote-settings.prod.webservices.mozgcp.net
34.149.100.209
truefalseunknown
sni1gl.wpc.nucdn.net
152.199.21.175
truefalseunknown
telemetry-incoming.r53-2.services.mozilla.com
34.120.208.123
truefalseunknown
bzib.nelreports.net
unknown
unknownfalseunknown
firefox.settings.services.mozilla.com
unknown
unknownfalseunknown
detectportal.firefox.com
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://www.google.com/favicon.icofalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://bzib.nelreports.net/api/report?cat=bingbusinessfalse
  • URL Reputation: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtabWeb Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/ac/?q=Web Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://www.msn.comZfirefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.orgfirefox.exe, 00000004.00000003.2318629722.000002824FDE2000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.mozilla.com0firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759314.0000028250C80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drfalse
  • URL Reputation: safe
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • URL Reputation: safe
unknown
https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 0000000A.00000002.2914602955.0000020471872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D492000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/apps-themesReporting and NEL.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.fontbureau.com/designersfirefox.exe, 00000004.00000003.2311885551.000002824FC35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2322994484.000002824FC3E000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://docs.google.com/manifest.json.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://screenshots.firefox.comfirefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://completion.amazon.com/search/complete?q=firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://ads.stickyadstv.com/firefox-etpfirefox.exe, 00000004.00000003.1914967684.000002825544C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2034804367.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1763594649.00000282547DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1775544242.000002825544C000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/breach-details/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1828923703.0000028254630000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.com/firefox.exe, 00000004.00000003.2037240163.0000028251288000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.msn.comfirefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867339086.00000282534B6000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/mozilla-services/screenshotsfirefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/setsfirefox.exe, 00000004.00000003.1918054767.000002824F326000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://api.accounts.firefox.com/v1firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/commonfirefox.exe, 00000004.00000003.1918054767.000002824F326000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-2.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://fpn.firefox.comfirefox.exe, 00000004.00000003.1916598710.0000028250C54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916623740.0000028250C3B000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullScfirefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=Web Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&ctafirefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-1.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://www.youtube.com/firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.carterandcone.comlfirefox.exe, 00000004.00000003.2405866958.0000028255058000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://127.0.0.1:firefox.exe, 00000004.00000003.1866682576.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1915549706.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2040070374.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2035608079.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2338266503.0000028253B37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mofirefox.exe, 00000004.00000003.1867339086.00000282534BF000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mitmdetection.services.mozilla.com/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://amazon.comfirefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://chromewebstore.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://drive-preprod.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://chrome.google.com/webstore/manifest.json0.7.drfalse
  • Avira URL Cloud: safe
unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://detectportal.firefox.comDfirefox.exe, 00000004.00000003.2312586154.00000282512F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042352471.00000282512F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867679424.00000282512F1000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://merino.services.mozilla.com/api/v1/suggestaboutfirefox.exe, 0000000A.00000002.2914602955.0000020471872000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-firefox.exe, 00000004.00000003.2035361775.000002825415E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.inbox.lv/rfc2368/?value=%sufirefox.exe, 00000004.00000003.2042477043.000002825129F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036768928.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1916161168.00000282512A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867828318.000002825129F000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/dashboardfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.tsn.caZfirefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.tsn.cafirefox.exe, 00000004.00000003.1908130566.0000051129303000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/aboutfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://mozilla.org/MPL/2.0/.firefox.exe, 00000004.00000003.1857460428.0000028251672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1773201996.0000028256DAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1743466064.0000028253DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864034209.0000028255D60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1915513621.0000028253BA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2041848582.0000028255C88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1863601457.0000028255DEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1866039130.0000028253DF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1850639289.0000028253DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860988677.0000028256392000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251662000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1866629158.0000028253B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1856457335.000002850003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1737402443.0000028254273000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867612498.0000028251E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1743466064.0000028253DF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860259245.00000282563E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2364849954.00000282519F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1853180016.00000282519F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867339086.0000028253463000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://account.bellmedia.cfirefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://login.microsoftonline.comfirefox.exe, 00000004.00000003.1773915468.0000028256D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859993863.00000282563EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859337550.0000028256D8E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://coverage.mozilla.orgfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0firefox.exe, 00000004.00000003.2040044137.0000028254651000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759314.0000028250C80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2048276902.0000028254800000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/AccountsSignInUiReporting and NEL.7.drfalse
  • Avira URL Cloud: safe
unknown
https://blocked.cdn.mozilla.net/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 00000004.00000003.1775544242.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1914967684.0000028255480000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2038570670.0000028255480000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/dates-and-times$firefox.exe, 00000004.00000003.1918054767.000002824F381000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.comfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mozilla.cloudflare-dns.com/dns-queryfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mail.yahoo.co.jp/compose/?To=%sfirefox.exe, 00000004.00000003.1731844398.0000028251633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2367561684.0000028251639000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042477043.00000282512BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2036672810.00000282512C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1851575978.0000028251623000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1867713617.00000282512BA000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgfirefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1917704798.000002824F3B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2914602955.00000204718C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2913105615.000001C06D4CF000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • URL Reputation: safe
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.icoWeb Data.7.drfalse
  • Avira URL Cloud: safe
unknown
https://contile.services.mozilla.com/v1/tilesfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.jiyu-kobo.co.jp/xHfirefox.exe, 00000004.00000003.2426015291.000002824FC2E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/preferencesfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://screenshots.firefox.com/firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864790749.000002825412A000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.google.com/searchfirefox.exe, 00000004.00000003.1718011485.000002825362C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717843142.0000028253617000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1719045959.0000028253681000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717471230.0000028253400000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718531256.000002825366C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718379441.0000028253657000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1718172412.0000028253641000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1828923703.0000028254630000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://relay.firefox.com/api/v1/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-autopush.corp.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-reportfirefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://topsites.services.mozilla.com/cid/firefox.exe, 0000000A.00000002.2913963684.0000020471520000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2916037067.000001C06D530000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://twitter.com/firefox.exe, 00000004.00000003.1868277547.0000028250C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045781494.0000028250C7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868277547.0000028250C68000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErrfirefox.exe, 00000004.00000003.1864626254.000002825575B000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.jiyu-kobo.co.jp/jp/firefox.exe, 00000004.00000003.2430312519.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424202810.000002824FC2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2423604180.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2426015291.000002824FC2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2421550161.000002824FC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2427825738.000002824FC2E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2424520445.000002824FC31000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
23.219.82.19
unknownUnited States
20940AKAMAI-ASN1EUfalse
13.107.246.67
s-part-0039.t-0009.t-msedge.netUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
152.195.19.97
unknownUnited States
15133EDGECASTUSfalse
142.251.40.106
unknownUnited States
15169GOOGLEUSfalse
142.250.176.206
unknownUnited States
15169GOOGLEUSfalse
162.159.61.3
chrome.cloudflare-dns.comUnited States
13335CLOUDFLARENETUSfalse
142.251.40.132
unknownUnited States
15169GOOGLEUSfalse
142.251.16.84
unknownUnited States
15169GOOGLEUSfalse
23.44.133.57
unknownUnited States
20940AKAMAI-ASN1EUfalse
172.64.41.3
unknownUnited States
13335CLOUDFLARENETUSfalse
52.222.236.48
services.addons.mozilla.orgUnited States
16509AMAZON-02USfalse
34.120.208.123
telemetry-incoming.r53-2.services.mozilla.comUnited States
15169GOOGLEUSfalse
34.149.100.209
prod.remote-settings.prod.webservices.mozgcp.netUnited States
2686ATGS-MMD-ASUSfalse
34.107.221.82
prod.detectportal.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
35.244.181.201
prod.balrog.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
142.251.40.97
unknownUnited States
15169GOOGLEUSfalse
35.190.72.216
prod.classify-client.prod.webservices.mozgcp.netUnited States
15169GOOGLEUSfalse

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1498716
Start date and time:2024-08-25 19:11:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 56s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:27
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:file.exe
Detection:MAL
Classification:mal68.evad.winEXE@72/331@26/20
EGA Information:
  • Successful, ratio: 66.7%
HCA Information:
  • Successful, ratio: 96%
  • Number of executed functions: 37
  • Number of non-executed functions: 312
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 108.177.15.84, 13.107.42.16, 204.79.197.239, 13.107.21.239, 216.58.206.46, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.74.195, 172.217.23.99, 2.23.209.140, 2.23.209.185, 2.23.209.187, 2.23.209.142, 2.23.209.183, 2.23.209.132, 2.23.209.141, 2.23.209.130, 2.23.209.135, 23.101.168.44, 199.232.214.172, 192.229.221.95, 142.250.186.110, 2.22.61.59, 2.22.61.56, 172.217.16.206, 142.250.81.227, 142.250.80.35, 142.251.32.99
  • Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, incoming.telemetry.mozilla.org, edgeassetservice.afd.azureedge.net, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, redirector.gvt1.com, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, detectportal.prod.mozaws.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com,
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

TimeTypeDescription
18:12:09AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
18:12:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
162.159.61.3file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
    file.exeGet hashmaliciousUnknownBrowse
      file.exeGet hashmaliciousUnknownBrowse
        file.exeGet hashmaliciousUnknownBrowse
          file.exeGet hashmaliciousUnknownBrowse
            file.exeGet hashmaliciousUnknownBrowse
              file.exeGet hashmaliciousUnknownBrowse
                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                  file.exeGet hashmaliciousUnknownBrowse
                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      13.107.246.67file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                        file.exeGet hashmaliciousUnknownBrowse
                          file.exeGet hashmaliciousUnknownBrowse
                            file.exeGet hashmaliciousUnknownBrowse
                              http://ca11he1lpn0wrnre112.pages.dev/fonts/media/media/js/scripts.jsGet hashmaliciousTechSupportScamBrowse
                                phish_alert_sp2_2.0.0.0.emlGet hashmaliciousHTMLPhisherBrowse
                                  file.exeGet hashmaliciousUnknownBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      https://mscom-mkt-prod135-t.adobe-campaign.com/r/?id=h1d799db,3d4ea2a,3d4ea2c&e=cDE9QG9zdlI3S2EwMGd4WGp5YXcxYWNRc3pDUU9GN3MwU2hzM2sweEpLYjEwZzNiUERYTDAtZUMwdHJRRWc3dHN1dXRNQmhWWWtWN0tyWkpmaDNBd2FtZnc2X2JWNnk4TE1PeEtwRXN2V2RnTkY5Rk13dFc&s=b4eT0hjhEXSLupJUbVuWEmZ9wVqdrJyG5oe8ap8okjMGet hashmaliciousUnknownBrowse
                                        https://hn9vah.fi90.fdske.com/ec/gAAAAABmxJTqV0E0MNsLcN0z2Vtn93rEsp3aAbbbOrxo0CCMpQE_-IMyTTBYCdqTPUSs0pFK-rAaAyqiRBTbSyDj8BAiwHQrQ5qZZJFpmQIPqsf-CvMYh70xJmMhWrwO2yMFjtiiINt59sAD4ilL4KjcXRxdEHcMTy9JVvUJgEVoJr8-cQ0MR7xEVmEMONefUy8eNRLT9NpOlvl6v3dkiNO4wgIBF6bP0JW_5FVWSeFORs0DCTpbceF1GKe5N62LtHGejuV9EXj2GImzKVDf6F3zyB5AhtuNj3a13Z6F90241cbr2Rl3DbNZUl4dSD8Gsvy72C7wrrnuHsQiHBS1rxVpM6yE5iw5FH6dJafaPuFTQLkLY0d0rB7_dkkWCTBnP8vrAxhRxDEX6mea0GCkMFqW74Z2tUnCvFAuLs_xqvZGmg76AjWIf8YsLOE43Ov-_kT0HxNPGCM8h2eP56QXc2-XCMljJJXi2A==#am9oYW5uLmZlaW5kZXJ0QGdhdHguZXU=Get hashmaliciousHTMLPhisherBrowse
                                          152.195.19.97http://ustteam.com/Get hashmaliciousUnknownBrowse
                                          • www.ust.com/
                                          23.44.133.57file.exeGet hashmaliciousBabadedaBrowse
                                            file.exeGet hashmaliciousBabadedaBrowse
                                              FAX_202405_136088.xhtmlGet hashmaliciousUnknownBrowse
                                                Payment Confirmation#U007e#U007e6985.rtfGet hashmaliciousHTMLPhisherBrowse

                                                  Domains

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  chrome.cloudflare-dns.comfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 172.64.41.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 172.64.41.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 172.64.41.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 162.159.61.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 172.64.41.3
                                                  example.orgfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 93.184.215.14
                                                  services.addons.mozilla.orgfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 52.222.236.23
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 52.222.236.120
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 18.65.39.31
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 52.222.236.23
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 18.65.39.85
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 18.65.39.85
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 52.222.236.48
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 3.165.190.59
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 52.222.236.80
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 52.222.236.23

                                                  ASNs

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  MICROSOFT-CORP-MSN-AS-BLOCKUSfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 94.245.104.56
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 94.245.104.56
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.40
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 94.245.104.56
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.60
                                                  Customer-orderlist-Bestellung0940670009988208.exeGet hashmaliciousRedLineBrowse
                                                  • 13.107.137.11
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.60
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 13.107.246.42
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 94.245.104.56
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 13.107.246.73
                                                  CLOUDFLARENETUSfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 162.159.61.3
                                                  SecuriteInfo.com.Win64.DropperX-gen.21682.4890.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.97.3
                                                  SecuriteInfo.com.Win64.CrypterX-gen.4166.17445.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.97.3
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 172.64.41.3
                                                  SecuriteInfo.com.Win64.DropperX-gen.4383.5748.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.96.3
                                                  SecuriteInfo.com.Win64.DropperX-gen.21682.4890.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.96.3
                                                  SecuriteInfo.com.Win64.CrypterX-gen.4166.17445.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.96.3
                                                  SecuriteInfo.com.Win64.DropperX-gen.4383.5748.exeGet hashmaliciousUnknownBrowse
                                                  • 188.114.97.3
                                                  SecuriteInfo.com.Trojan.InjectNET.17.22811.18368.exeGet hashmaliciousLummaCBrowse
                                                  • 172.67.148.102
                                                  SecuriteInfo.com.Trojan.InjectNET.17.22463.10190.exeGet hashmaliciousLummaCBrowse
                                                  • 104.21.95.208
                                                  EDGECASTUSfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 152.195.19.97
                                                  AKAMAI-ASN1EUfile.exeGet hashmaliciousUnknownBrowse
                                                  • 23.59.250.56
                                                  Selenium.exeGet hashmaliciousLummaCBrowse
                                                  • 23.197.127.21
                                                  file.exeGet hashmaliciousLummaCBrowse
                                                  • 23.197.127.21
                                                  file.exeGet hashmaliciousVidarBrowse
                                                  • 23.197.127.21
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 23.59.250.25
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 23.59.250.64
                                                  HPSupportSolutionsFramework-13.0.1.131.exeGet hashmaliciousLummaCBrowse
                                                  • 23.197.127.21
                                                  0RmMail.exeGet hashmaliciousLummaCBrowse
                                                  • 23.197.127.21
                                                  0qbittorrent.exeGet hashmaliciousLummaCBrowse
                                                  • 23.197.127.21
                                                  continuesurf.b-cdn.net.ps1Get hashmaliciousLummaCBrowse
                                                  • 23.197.127.21

                                                  JA3 Fingerprints

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  28a2c9bd18a11de089ef85a160da29e4file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.cexz.top%2FTrade%2Ftradelist.html%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR3QXxe8AlutZYqRLhy6kfcRHX7ox79ANtoHkL5MFDvM9u_NxfXkkNAfcbE_aem_UDbPgNljQReqTdyzL1qAnA&h=AT0q7wmRkcJcM0QgxkcKmXpzdiZ2ZUH5T5Kvlz7u1IbzLVp1YAb0xfnp9rD61UTjjRPU9g0CsI9wwbfTxhZZHMiitY__RjpLcm73Ll-O6mHfrnKHdskDQLcrIZpxdHQfGWYjzAGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  http://www.ananlcc.org/Get hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 184.28.90.27
                                                  • 20.114.59.183
                                                  fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                  • 35.244.181.201
                                                  • 34.149.100.209
                                                  • 52.222.236.48
                                                  • 34.120.208.123

                                                  Dropped Files

                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                    file.exeGet hashmaliciousUnknownBrowse
                                                      file.exeGet hashmaliciousUnknownBrowse
                                                        file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                          file.exeGet hashmaliciousUnknownBrowse
                                                            file.exeGet hashmaliciousUnknownBrowse
                                                              file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                  file.exeGet hashmaliciousUnknownBrowse
                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                            file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                              file.exeGet hashmaliciousUnknownBrowse
                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                      file.exeGet hashmaliciousUnknownBrowse
                                                                                        file.exeGet hashmaliciousUnknownBrowse

                                                                                          Created / dropped Files

                                                                                          C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_d6c80488-2efd-4cec-a9b1-f5956636def3.json (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6439
                                                                                          Entropy (8bit):5.144693407858506
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:gZjMX02pcbhbVbTbfbRbObtbyEzn/nSrDtTJdB:MYpcNhnzFSJ5nSrDhJdB
                                                                                          MD5:CE60681DC178A4179AA5A84B6C6DA5E5
                                                                                          SHA1:E05100E8CD6BB3DF2D95354135986F56282D69C5
                                                                                          SHA-256:66C65558F74116ED94E05A493823016E3651BEF18A44925B9C0D9D3C0320639F
                                                                                          SHA-512:97C0FF051A790625A5F991EB40E0B43B42249039EA5218ED90B7067B7102EA38E13DB9F9AC4D07AC7864F228687A96E67B03213E9F580F8C1112468600DED73C
                                                                                          Malicious:false
                                                                                          Preview:{"type":"uninstall","id":"d6c80488-2efd-4cec-a9b1-f5956636def3","creationDate":"2024-08-25T18:55:05.532Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                          C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_d6c80488-2efd-4cec-a9b1-f5956636def3.json.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6439
                                                                                          Entropy (8bit):5.144693407858506
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:gZjMX02pcbhbVbTbfbRbObtbyEzn/nSrDtTJdB:MYpcNhnzFSJ5nSrDhJdB
                                                                                          MD5:CE60681DC178A4179AA5A84B6C6DA5E5
                                                                                          SHA1:E05100E8CD6BB3DF2D95354135986F56282D69C5
                                                                                          SHA-256:66C65558F74116ED94E05A493823016E3651BEF18A44925B9C0D9D3C0320639F
                                                                                          SHA-512:97C0FF051A790625A5F991EB40E0B43B42249039EA5218ED90B7067B7102EA38E13DB9F9AC4D07AC7864F228687A96E67B03213E9F580F8C1112468600DED73C
                                                                                          Malicious:false
                                                                                          Preview:{"type":"uninstall","id":"d6c80488-2efd-4cec-a9b1-f5956636def3","creationDate":"2024-08-25T18:55:05.532Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\028d75f5-6b56-4657-8e73-84b2a0b2efc9.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24007
                                                                                          Entropy (8bit):6.049833725784177
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTP8aRkIvX4Rm336kVvt6d:nM7X2zt1jKYqHkZeM1hDV7TUzHRkIvXE
                                                                                          MD5:CC38BB789E9299CA021D3D65BE32B27B
                                                                                          SHA1:2B87863713F826FA86504B48196B0866BDB2F9D6
                                                                                          SHA-256:2260F46E3E51A828947F6975E840E7E9B091CB136913F96F6A4C5E29803DDC2A
                                                                                          SHA-512:7BFB62A6B4F3FAE44792674C7FFD4C32C95EA87337E661C5A66B372176A762453253A6ED729A6CC65DACE9EB30CCE66EC2228469A737BEE6BA7547F39430765C
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\02c8b1b2-327e-4f96-8fdd-b051657c3875.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):8239
                                                                                          Entropy (8bit):5.794828265348182
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:fsNABkeiRUUjLjGkI96qRAq1k8SPxVLZ7VTiQ:fsNAE1j3VI96q3QxVNZTiQ
                                                                                          MD5:97DFFC304B3180CDFD4487E4A4670F55
                                                                                          SHA1:A395F8EDC2B5873C587CB115BDC6F211E097D7FF
                                                                                          SHA-256:4C038ABEE9E098AFF4532BB57CAD5F490BD4F51C0F56EACF7E7619B34F3C25D5
                                                                                          SHA-512:A95EBFD81028A72E938FA7FB04D0D605BD3D93121A166B0FC15448F475C807795F9B2F92CE71CCA8F0EA307AF4FB709AD52ED00D1F596EA190F27F05885E35D0
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0d136d82-1659-42fd-a05c-7f1eacd9b444.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:modified
                                                                                          Size (bytes):8090
                                                                                          Entropy (8bit):5.8119875379774575
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:asNABkeiRUQGQGkIZt6qRAq1k8SPxVLZ7VTiq:asNAElXVIf6q3QxVNZTiq
                                                                                          MD5:52186A96106F6DB0CFD7B6FAB1C7580F
                                                                                          SHA1:F0FA90B7C46163533E8CC47EF471888AB5136941
                                                                                          SHA-256:7454165C488AD92465ECF774529AE39F9B56415EF232B9304DF2DDCF101F3FA5
                                                                                          SHA-512:C93FB2E2C8259F77AC219F1EED6DD32A266CC2A4CABAA72ACAC3BEAE00C6A92C7CFA321C9458B57CDB1B2B96120BB3DED7F937980E466D1DA972E8CE6D059596
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\230ce5a0-2218-461b-978b-7a68c646cf2b.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:modified
                                                                                          Size (bytes):24007
                                                                                          Entropy (8bit):6.049833725784177
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTP8aRkIvX4Rm336kVvt6d:nM7X2zt1jKYqHkZeM1hDV7TUzHRkIvXE
                                                                                          MD5:CC38BB789E9299CA021D3D65BE32B27B
                                                                                          SHA1:2B87863713F826FA86504B48196B0866BDB2F9D6
                                                                                          SHA-256:2260F46E3E51A828947F6975E840E7E9B091CB136913F96F6A4C5E29803DDC2A
                                                                                          SHA-512:7BFB62A6B4F3FAE44792674C7FFD4C32C95EA87337E661C5A66B372176A762453253A6ED729A6CC65DACE9EB30CCE66EC2228469A737BEE6BA7547F39430765C
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30b31b81-f1c3-402c-83cb-4d0a93837bf0.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):22892
                                                                                          Entropy (8bit):6.046204117879423
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTLwIX4Rm336kVvt6w4:nM7X2zt1jKYqHkZeM1hDV7TU3wIX4R8K
                                                                                          MD5:55F798F5DBD3B1B949DF2762242C2DA1
                                                                                          SHA1:8364A0249AEE79245A675123BF6136FA7611A5D9
                                                                                          SHA-256:5D2123CFECF65DAE0619562CB1DBDE3233504320ABC695033A2187DF43C50D3E
                                                                                          SHA-512:EDAB42EE9E08009A8FFA9F9DDD90D37ADE214ED66D54E9C4684F8B9086CB3A17F80A7B1A188E7779BB74B3BF6BAAB65E402F1E73C3E8A40CDFCBE61D85615739
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\44907d5e-9d58-491c-91bd-06157eb56e7a.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):8090
                                                                                          Entropy (8bit):5.8119875379774575
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:asNABkeiRUQGQGkIZt6qRAq1k8SPxVLZ7VTiq:asNAElXVIf6q3QxVNZTiq
                                                                                          MD5:52186A96106F6DB0CFD7B6FAB1C7580F
                                                                                          SHA1:F0FA90B7C46163533E8CC47EF471888AB5136941
                                                                                          SHA-256:7454165C488AD92465ECF774529AE39F9B56415EF232B9304DF2DDCF101F3FA5
                                                                                          SHA-512:C93FB2E2C8259F77AC219F1EED6DD32A266CC2A4CABAA72ACAC3BEAE00C6A92C7CFA321C9458B57CDB1B2B96120BB3DED7F937980E466D1DA972E8CE6D059596
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4ad6c8f1-4d42-4876-8728-479e199a8ff2.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):25093
                                                                                          Entropy (8bit):6.031668204163401
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:nM7X2zt1jKYqHkZeJ1hDV7TUJYgqVIX4R836kJt6+:nMSzvKYqsu1z7TA36ct6+
                                                                                          MD5:95C6D50D440E4DED61864EB830A68BEF
                                                                                          SHA1:988913A027261F82977958E4CCDFBFD745FF901F
                                                                                          SHA-256:71949E4A4122BBF5C24012B389D6ABAD6CEF4FF274C1A111C86F9E88127E7AB4
                                                                                          SHA-512:D97E3FE295B0D885FFB69EF9D2413ACCCE5548E3B5C76CF4779FBD9DCBA892CA58A689B86BEA0D58EE765824D60C190807F8854CBDA41A3D881ECDDA8BAFF00D
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\60bacce8-baee-4eaf-8029-2761b5de0920.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):22965
                                                                                          Entropy (8bit):6.0467951225727345
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTEVIX4Rm336kVvt6wR:nM7X2zt1jKYqHkZeM1hDV7TUIVIX4R8z
                                                                                          MD5:4D125FDCEE5EA1F0D40EE7D4F77D059E
                                                                                          SHA1:83CAC483A833A3360E6DAA36B3C56BA250500D73
                                                                                          SHA-256:8E9A44B5553FA6DBE6F0E3F47F327F07C2004254D040754DF7D0584E8243A0C2
                                                                                          SHA-512:0B58C10B0542AEAC67E97B3EDE42035825BFE19FD6C9652BF528DF66AF352DDE16A5A83382665AEFA9220D7F711AD6A640EF57492C1EF13A73F575AC58A0FFF1
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\66216aca-92c4-4c65-b7a3-99268891916f.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):25093
                                                                                          Entropy (8bit):6.031674894789304
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:nM7X2zt1jKYqHkZeJ1hDV7TUJYg1VIX4R836kJt6+:nMSzvKYqsu1z7T536ct6+
                                                                                          MD5:F4D1744DC863EEB75BF10438D7E942E2
                                                                                          SHA1:6AB3C91A5E4A4DDC5BC08E3965B45A357E3C48A8
                                                                                          SHA-256:09B39B8CA74C9D6880FA49DCDF903E45CCB8C0E41E0A7E3F8B47F5E24355C76A
                                                                                          SHA-512:F32C7A846BAE88AAEDF408AFE92B95AC4CC0387C54123DB4C1267E58EFB7561229FF584B5556F93289EF1A5C45E62CCCC038889A2F599EB59C9FA20F874A2594
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8a8b3711-a49e-438e-bcb2-bcb845b8534f.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24007
                                                                                          Entropy (8bit):6.049846479294043
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTP8a3/IvX4Rm336kVvt6d:nM7X2zt1jKYqHkZeM1hDV7TUzH3/IvXE
                                                                                          MD5:31797682DA651A616B5D36A8DD11BE45
                                                                                          SHA1:EA5965599063BC610EB0EF69E718EF6E8CEC872C
                                                                                          SHA-256:FD63F19300DC6D990DADEDE7065DC2BA81EED8AA62616BDA0B6E627F2CACAF84
                                                                                          SHA-512:7A7FD1FE4C036DE03D355B45CB13495AA904241535C1C1EEC71ADB3EE1DACDD1353F9F306B184DA57B570630335FDA4A24BA7BC94C222C30E6F7D6B3539578CA
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\982ac3b9-4260-4eac-9ed7-884d785bbbdb.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:modified
                                                                                          Size (bytes):24007
                                                                                          Entropy (8bit):6.049846479294043
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:NtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh7DVYATUTP8a3/IvX4Rm336kVvt6d:nM7X2zt1jKYqHkZeM1hDV7TUzH3/IvXE
                                                                                          MD5:31797682DA651A616B5D36A8DD11BE45
                                                                                          SHA1:EA5965599063BC610EB0EF69E718EF6E8CEC872C
                                                                                          SHA-256:FD63F19300DC6D990DADEDE7065DC2BA81EED8AA62616BDA0B6E627F2CACAF84
                                                                                          SHA-512:7A7FD1FE4C036DE03D355B45CB13495AA904241535C1C1EEC71ADB3EE1DACDD1353F9F306B184DA57B570630335FDA4A24BA7BC94C222C30E6F7D6B3539578CA
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):107893
                                                                                          Entropy (8bit):4.640139867263744
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
                                                                                          MD5:515BFDD0A8E03F491ED66894DAC7434B
                                                                                          SHA1:00534E56EA194556D8E48772D2463BB291B567AC
                                                                                          SHA-256:C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
                                                                                          SHA-512:649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
                                                                                          Malicious:false
                                                                                          Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d7c8e84c-5425-44d2-ae32-6d31c0350450.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):107893
                                                                                          Entropy (8bit):4.640139867263744
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
                                                                                          MD5:515BFDD0A8E03F491ED66894DAC7434B
                                                                                          SHA1:00534E56EA194556D8E48772D2463BB291B567AC
                                                                                          SHA-256:C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
                                                                                          SHA-512:649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
                                                                                          Malicious:false
                                                                                          Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3::
                                                                                          MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                          SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                          SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                          SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3::
                                                                                          MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                          SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                          SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                          SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CB65DE-DB8.pma

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.03986557719903982
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:Uh01utmqvDzKX7e8J8iD12absbZHtgbXxh8IYhojgNE//cRQMcZf1n8y08Tcm2Rl:y0EtJ8lWCYh9KQIf108T2RGOD
                                                                                          MD5:047E0454E0F1A3D62882EC8BF0BA344E
                                                                                          SHA1:B26D6FF1CF07B6B6719E479B8632DD613F06D3F7
                                                                                          SHA-256:468B50707E5F6978D006D35EFADAF15126C059301828BDDB8521A137292549D0
                                                                                          SHA-512:00D2F3F3A17E545F6B27BF34FE5BBF4E6DF816D15556BCF644F1A2508D2D84E9494C672538C7A0A49D8383386DED096D5B212F324D8756D0DBCFC7726CB70353
                                                                                          Malicious:false
                                                                                          Preview:...@..@...@.....C.].....@...............xa..0Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".wgbhvh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U.>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CB65E0-1C14.pma

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.46325028888344305
                                                                                          Encrypted:false
                                                                                          SSDEEP:6144:hrixqpHOBs7PaHb5nfEQVqo8lYAPQaHdG:3Cs7CtYb
                                                                                          MD5:72BA93D5D53D068B085EA6947D368C8B
                                                                                          SHA1:D1AB75FF19D8133544A215C88B8A449D68EA5290
                                                                                          SHA-256:41A48F2EE9C67EDA81C4F5441A50AAF90FBB8FA22F47B8529828C3035BB334C3
                                                                                          SHA-512:627D0F604E6DED51A7896A8E2DA4310BFF1FE0F11D5C10CADAA96F37EAD5E26D854F247393038C8D1EADF880579C4C466C501754FD21F576070F0402ABE3718D
                                                                                          Malicious:false
                                                                                          Preview:...@..@...@.....C.].....@............... ...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".wgbhvh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U?:K..>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..$...

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CB65F1-88C.pma

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.04076698666580736
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:YV0EbtmqvDtKX7eDJEa3XxxTxqZ/g+Xv970RVRBThk7NonG1gQMlnlWn8y08TcmQ:a0EtLDeK8YyMhysCgJnI08T2RGOD
                                                                                          MD5:BE0454AB75888BC0F4686C1D4DD64E28
                                                                                          SHA1:E3DFA3150D8D9C4B88DFC5A2644A75B8D707EECA
                                                                                          SHA-256:A9930C02EF780839AE8F21101E783FF2812767E52340056ABCBBA23C06FE5141
                                                                                          SHA-512:745FF698AB80FD338FEEEA80200200328978E7294E6D5A095C457FCACB52BEA788D544BD5BEC5533BC9F8F827F62DD762E0198F9E5781B276743ED6A2CB1CA70
                                                                                          Malicious:false
                                                                                          Preview:...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".wgbhvh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66CB65F9-2154.pma

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4194304
                                                                                          Entropy (8bit):0.03984153805896207
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:xU0EbtmqvD3KX7SJEa3Xxx7uqZGXPtg34khtbNE3kMO1gQpehi65Z7n8y08Tcm2D:S0EtHe18xphlcagwqi+Z08T2RGOD
                                                                                          MD5:5E875488ABB619AE5C5E59068CE3F165
                                                                                          SHA1:6586533638F74DD0EE7DF0B3EFCA25586482D4EA
                                                                                          SHA-256:B19C4C979897A6B8FF1E49B4610B6C32267E3E40D43CA7D37E96FA1DCCFF3762
                                                                                          SHA-512:A9ACB79858C95CA3C2C15F608C34E02A7B82BAE5FDBB7A95DB7E1E129681BFFD937AEAC7AE4AE9A058581FDD0FC3F5AC242320AB67DB5D18D7E037F03ABDDD2B
                                                                                          Malicious:false
                                                                                          Preview:...@..@...@.....C.].....@...............h^.. N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".wgbhvh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):16384
                                                                                          Entropy (8bit):0.3553968406659012
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                                                          MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                                                          SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                                                          SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                                                          SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                                                          Malicious:false
                                                                                          Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):280
                                                                                          Entropy (8bit):3.060980776278344
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
                                                                                          MD5:74B32A83C9311607EB525C6E23854EE0
                                                                                          SHA1:C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
                                                                                          SHA-256:06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
                                                                                          SHA-512:ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
                                                                                          Malicious:false
                                                                                          Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\11576c4e-7e46-438d-b6e5-105d15882eeb.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24853
                                                                                          Entropy (8bit):5.56592859812683
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:DhuNDQWPw2f7y8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs1G10rwLpttuw:DhuNDQWPw2f7yu1jadM1trtP
                                                                                          MD5:9131FD1922500EE5BEE554C22990B99C
                                                                                          SHA1:3985C53D38607DCDFD2B8E9AEE9A06C8F83379F0
                                                                                          SHA-256:9998653AA260B4F1C34841BAB8027F66F2052D5C1461348FE3B66480A93C544A
                                                                                          SHA-512:5F509287A010DDB70B23AC92DDD51ED80E7EDD661EB3602F92A6A8603A9286A5ED38E8E5AA5CD1F00015D2B0B6DED913CF93B35887FEB0E823C08966BF2BCC61
                                                                                          Malicious:false
                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369079521268835","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369079521268835","location":5,"ma

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53b73e31-1fb2-46cd-a692-b520b5a2d455.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:very short file (no magic)
                                                                                          Category:dropped
                                                                                          Size (bytes):1
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:L:L
                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                          Malicious:false
                                                                                          Preview:.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\692e72be-8b78-47ff-ba24-74f79aed148c.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):9751
                                                                                          Entropy (8bit):4.9509983852249775
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:sVDkdBYXJ1uBb91AXaYa3eC85Th6np9/x+6M8muecUi1eAeCjr1e4zvrRl2BHQyn:sVDkdqJEmXaYa3eC80pj+FPiQAdH7a1f
                                                                                          MD5:CA641C9D5900A9F19A2022066AB15154
                                                                                          SHA1:A881EEE53983F4FCA11FA07F6A9DCE24C03BF0BD
                                                                                          SHA-256:3D431095B1995871B580DBCAD41AEA579D4DE57C6217B8340893DD39949B78C7
                                                                                          SHA-512:D46A67012B9CB194C91D23136161F470EBDD01C9FC0A0AEFFF3CE36AEF3DF7127CCE692F6B313C643152AD562E2D4DFF8DE1071AD88C9A4E46050EABA1512EB9
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\923763f3-1d9f-47fc-ba6b-14d2ff780e1e.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):11061
                                                                                          Entropy (8bit):5.171558803822243
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:sVDkdqJEmXors8UiYa3eC80pj+FPiQAMzF7a1f:sVDpJEmXb8U0pUqQFzFQ
                                                                                          MD5:A9D1F52D4E0E1986EA5D68296541EF34
                                                                                          SHA1:9CC55A4633D6420DAA15F3DDDEE059A31482E9CC
                                                                                          SHA-256:8183094D039909981F5E48C58875219FE5A02A738EDF938F512D537153D89B1A
                                                                                          SHA-512:D9B35DE5E96224FD836F30DE2511FD23E167870425A5E79AAD48BB83017E453CC3D7DD435C6E88952460D3926774F39FDABF34A0FBB00F86F89F174CD438A36C
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:modified
                                                                                          Size (bytes):12991
                                                                                          Entropy (8bit):5.384293741030139
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:LArlAEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:05AEOKSXs/J7mGnQmLu5/5eNdl
                                                                                          MD5:A79A80C5BEAA7E8C7A529C5BC6122764
                                                                                          SHA1:169E90DE43C101C1AD23E0BDAB60EF59D275A5B5
                                                                                          SHA-256:BD791CC2F2E1D97A4F08335A371C22A6F0AB90B9388DA0EAF5914EB8F2C30AF9
                                                                                          SHA-512:571A9C1EB2F8B5279ACDE081FB655D889F1005FBDA3ACFAED7984E3DB7F86F6570896C12A652DB98D143829F1502585CE929C1B0A7B20BE953A729C8A7E849D2
                                                                                          Malicious:false
                                                                                          Preview:...m.................DB_VERSION.1...E.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13369079527654274.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}].G...................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7.*.13369079527671216.$QUERY:edge_hub_apps_manifest_gz4.7.*..[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):293
                                                                                          Entropy (8bit):5.1197477621814835
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUnahq1wkn23oH+Tcwt9Eh1ZB2KLlLdU0Kq2Pwkn23oH+Tcwt9Eh1tIFUv:Np1fYeb9Eh1ZFL1AvYfYeb9Eh16FUv
                                                                                          MD5:F50EF5A7D2C4D1F178A0CA762DABD252
                                                                                          SHA1:D253148C80760162CFAE036B343CE9718EBCA501
                                                                                          SHA-256:EF790BA11CF276A05B12DCA06856FA11879160849563EEB1ABA3AC1BECBEE127
                                                                                          SHA-512:4917D030E804C7C43F387E3BD62A89F8373B1CD3C6AB1C60EA275701523185E2ADFD935566245B3858ACAC0F241FB85578198D98265329DE1020C8E9593FE16D
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:06.554 2240 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/25-13:12:06.773 2240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):12288
                                                                                          Entropy (8bit):0.3202460253800455
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                          MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                          SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                          SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                          SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):28672
                                                                                          Entropy (8bit):0.46470070171396605
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBNjmB:TouQq3qh7z3bY2LNW9WMcUvBY
                                                                                          MD5:1E9BDAE3DD4C281979E9AB0904F86003
                                                                                          SHA1:7F35159273C31FE01EF53E03E458F73A3BEEF36E
                                                                                          SHA-256:A27F56E5FF038F2D1C324020F099ED7E524764F4A65A6188803EE21A7B5C235C
                                                                                          SHA-512:F63663295C41F808E1568271A48D98A23DA98F676284BB880C82DD2B83356F0830BC8C716FA6CCFFFD6230ED740DE640E2557641E9DFF8647DD0C7872EAB168E
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):8.280239615765425E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                          MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                          SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                          SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                          SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):262512
                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsNlCQll:Ls3CQ
                                                                                          MD5:E98570EFF61CC76396D91B971B4ACD1C
                                                                                          SHA1:FC8470CAA5BCD521B093EC813750D065F2901B83
                                                                                          SHA-256:2881CD5F459A48C3A1209A0EB69A7AF7EFDFACBA55506A000B4D826DA0D4CB43
                                                                                          SHA-512:9DAF5AC8E1D782251217EB3436A993B74B6F67469E26A225ADAE09515DFFF465E3CEEDD1112B5733AD54FC6A85455A6074D5ADD2940BA65E7FBBFC708F835537
                                                                                          Malicious:false
                                                                                          Preview:...........................................c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33
                                                                                          Entropy (8bit):3.5394429593752084
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                          MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                          SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                          SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                          SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                          Malicious:false
                                                                                          Preview:...m.................DB_VERSION.1

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):305
                                                                                          Entropy (8bit):5.2017471715636825
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUQYwB1wkn23oH+TcwtnG2tbB2KLlLdUhBjM+q2Pwkn23oH+TcwtnG2tMsIFUv:NnY7fYebn9VFL1sBjM+vYfYebn9GFUv
                                                                                          MD5:32229C491F6FC68C8B5E8E89D2CCF6F8
                                                                                          SHA1:53CC2742D5EAC50F9355F9D33DB0A2C7D4AC9994
                                                                                          SHA-256:10E7CFF40FE8F075F21319F374A39A6E3699C96B9DBCBA5AEFEB99655F495953
                                                                                          SHA-512:A49AF15342E668EFA68ED2167CC53A3B803F31956DF78A58B2BDCD843D0272B37C89F32C55F56F93F4C1CADBC29952F1F52F0366C2867697EFFF70AE90D2F6A1
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.343 1d8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/25-13:12:01.387 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                          Category:dropped
                                                                                          Size (bytes):32768
                                                                                          Entropy (8bit):0.494709561094235
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                          MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                          SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                          SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                          SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):0.5094712832659277
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
                                                                                          MD5:D4971855DD087E30FC14DF1535B556B9
                                                                                          SHA1:9E00DEFC7E54C75163273184837B9D0263AA528C
                                                                                          SHA-256:EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
                                                                                          SHA-512:ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):375520
                                                                                          Entropy (8bit):5.354098791314542
                                                                                          Encrypted:false
                                                                                          SSDEEP:6144:rA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:rFdMyq49tEndBuHltBfdK5WNbsVEziPU
                                                                                          MD5:EFF14ABB18E3B175EB58C6F6A83DD298
                                                                                          SHA1:CC8D9B06EE6DDF0E802D18070ED0524BA430487E
                                                                                          SHA-256:C513DAA4C70294401EFE098D62A821B03DC8AE72F488CF801A0C0C18F815D488
                                                                                          SHA-512:6C5DAAF128BA87D176848E4C52A02C291716F1F8220B785E1D47440483C034DC89F1AA420C3CEB2154E0ADC679D1343C0169870EA559ED4588727ED079AA33A8
                                                                                          Malicious:false
                                                                                          Preview:...m.................DB_VERSION.1.5.*q...............&QUERY_TIMESTAMP:domains_config_gz2.*.*.13369079527641318..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):309
                                                                                          Entropy (8bit):5.194357685378591
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUYVs1wkn23oH+Tcwtk2WwnvB2KLlLdUICq2Pwkn23oH+Tcwtk2WwnvIFUv:NpNfYebkxwnvFL1+vYfYebkxwnQFUv
                                                                                          MD5:02C2BDBE5D4C3BF94C833E20B7B59B0C
                                                                                          SHA1:5121EE0FD5B2363607FF6C21715A0555BAB08011
                                                                                          SHA-256:D54C926C691544C0B6922EF45E6FA831CB2AC36A5ED2F541C2B77888D31B5497
                                                                                          SHA-512:84684F1445F4DA408A157B6A08EFDC2D1ED5CC44FE7F92272AA71FEA75E3FAF5795C37A748957626D5FAA9AC6C8AF6754BE01FFFB3D6855B1CDDCD97F75D807A
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:06.667 2250 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/08/25-13:12:06.925 2250 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:modified
                                                                                          Size (bytes):358860
                                                                                          Entropy (8bit):5.32461446209685
                                                                                          Encrypted:false
                                                                                          SSDEEP:6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RB:C1gAg1zfvZ
                                                                                          MD5:B659AD4E38FC4ABD77CDBE356F778351
                                                                                          SHA1:9248E4990E8C1D0FAE943CCB3F2F43A7B902A34F
                                                                                          SHA-256:FE2BC6E3FB80ED46DB56B49027F2C995593BA410999A68B8B0913985D74CCF17
                                                                                          SHA-512:F08C4652EEFBA552626085A02B2EAD33F78C49467B5E72553F472BC6C60FFEAF68C532FEBB22FF755B5EB10C5F04A7716FB782270335C34D7EE48BEE5A3AD618
                                                                                          Malicious:false
                                                                                          Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):209
                                                                                          Entropy (8bit):1.8784775129881184
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                          MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                          SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                          SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                          SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                          Malicious:false
                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):281
                                                                                          Entropy (8bit):5.148433922257202
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdU22m81wkn23oH+Tcwt8aVdg2KLlLdUwfN+q2Pwkn23oH+Tcwt8aPrqIFUv:NTbfYeb0L1x+vYfYebL3FUv
                                                                                          MD5:33D75E62CBB56EC4438ADE3A01021EA5
                                                                                          SHA1:186CEBB360636044D3839C99C4DBE163F031A468
                                                                                          SHA-256:FC30E3F55F0F0BE2D54B165303FE7E71E6905971386C82243BD42E6DC1DD74E6
                                                                                          SHA-512:144C9EF898368D37D079601CEE33911A16CBC5E451E9507AACAF601F1603248D595676945F5F2EAB2A5A63B089562465C55539C0B40984F7729377E7C9FAE6E2
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.341 1dcc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/25-13:12:01.351 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):209
                                                                                          Entropy (8bit):1.8784775129881184
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                          MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                          SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                          SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                          SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                          Malicious:false
                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):285
                                                                                          Entropy (8bit):5.165265591506755
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUwq81wkn23oH+Tcwt86FB2KLlLdUIi+q2Pwkn23oH+Tcwt865IFUv:NObfYeb/FFL18+vYfYeb/WFUv
                                                                                          MD5:E4BB7574E19329DEDE8B57D92F141D2C
                                                                                          SHA1:34CBA0AB3C915E9715101871FD7E4DFA7784A643
                                                                                          SHA-256:D87EC615BEE669D6019C9EF940881EF95478F222499656C12E09719A75D689E9
                                                                                          SHA-512:7B06530033CB5C2629150EE0B228D4F34968C92829CCCAFFF054A7A59C76FA3A8D959B1BBC52406567574B82DBB89DA9AE2A92349A3651BCE0E945F033FDF43A
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.355 1dcc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/25-13:12:01.367 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1197
                                                                                          Entropy (8bit):1.8784775129881184
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                          MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                                                          SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                                                          SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                                                          SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                                                          Malicious:false
                                                                                          Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):322
                                                                                          Entropy (8bit):5.165608781611268
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUk7+q2Pwkn23oH+Tcwt8NIFUt88dUA4Zmw+8dUAIVkwOwkn23oH+Tcwt8+eLJ:NavYfYebpFUt88b4/+8bg5JfYebqJ
                                                                                          MD5:470E6E7DEE7F6EB3139C0403908436A9
                                                                                          SHA1:68DF30C9BC7B8F57CC64846EA061F9B44ACFAE5E
                                                                                          SHA-256:1AD1749D2DA9985956F63340F7B6A659AB38178DC709FB59977BCC35AB553D0B
                                                                                          SHA-512:69166628D13EA9F94483AF3FCCA62E1226271DC84FCD324160B5631E1D4B9A53C5F7742A05F4881A6B6351CEA6C267361F97B9CB711BE98DF3F1D7CDD46CBD69
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.418 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/25-13:12:02.420 1d98 Recovering log #3.2024/08/25-13:12:02.420 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):322
                                                                                          Entropy (8bit):5.165608781611268
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUk7+q2Pwkn23oH+Tcwt8NIFUt88dUA4Zmw+8dUAIVkwOwkn23oH+Tcwt8+eLJ:NavYfYebpFUt88b4/+8bg5JfYebqJ
                                                                                          MD5:470E6E7DEE7F6EB3139C0403908436A9
                                                                                          SHA1:68DF30C9BC7B8F57CC64846EA061F9B44ACFAE5E
                                                                                          SHA-256:1AD1749D2DA9985956F63340F7B6A659AB38178DC709FB59977BCC35AB553D0B
                                                                                          SHA-512:69166628D13EA9F94483AF3FCCA62E1226271DC84FCD324160B5631E1D4B9A53C5F7742A05F4881A6B6351CEA6C267361F97B9CB711BE98DF3F1D7CDD46CBD69
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.418 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/25-13:12:02.420 1d98 Recovering log #3.2024/08/25-13:12:02.420 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):4096
                                                                                          Entropy (8bit):0.3169096321222068
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                          MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                          SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                          SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                          SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):32768
                                                                                          Entropy (8bit):0.40981274649195937
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                          MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                          SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                          SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                          SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):429
                                                                                          Entropy (8bit):5.809210454117189
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                          MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                          SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                          SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                          SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                          Malicious:false
                                                                                          Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):2.445531514325092
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:0BCyvkU+uwIelS9nsH4/AztctuuoKwxU+uu:mNvkJAsHXzCtPo1xb
                                                                                          MD5:3F0792CE0B1A6E2A6C0B5A7C4E0DCCAD
                                                                                          SHA1:234314782E0C17E04B68464A3E4202E718064A30
                                                                                          SHA-256:72D42289D2E0383494037FB11FFDF6119E3FEE16BA654C5B469A700F217F06EA
                                                                                          SHA-512:31DD7AEBD523268729B8ECB713C98F26139A04A3B9B082252BC25F4E613CFDD06C7ADE62221F50DA7600CBEB28B9553884B1EC94D92D8BE67E3183CB9B9E11D1
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 4
                                                                                          Category:dropped
                                                                                          Size (bytes):159744
                                                                                          Entropy (8bit):0.6462020084543791
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:IU+uXVS5syU+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjNChU+u:IEVSs+GPXBBE3upb0HtTTDxVjk
                                                                                          MD5:8CD2E2976AB1386CDFB79F78EBBEB2A0
                                                                                          SHA1:C48035E2A9551C6424D17736DA71CD0281B03DAE
                                                                                          SHA-256:EBF13BF2D85923CFD86A6FA3CABC78491C85FAF32E4ECD5D88BC391CC947433D
                                                                                          SHA-512:30031985D181793520E23B89F8C4A88EFCF3529F651BC9D798369ED780C252C0CB40427D3E1A519D686260E564BECBA9B420F0CBCFDFA80FA3895196E5514DCB
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8720
                                                                                          Entropy (8bit):0.3287299040996806
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Dl0A/J3+t76Y4QZZofU99pO0BYicqR4EZY4QZvGN:nhHQws9LdNBQZGN
                                                                                          MD5:D6CC58DD6F42B12B4E3DACC6E526A50B
                                                                                          SHA1:D210E465FC4577D7CA3B856601A5AAFA5AFBC29A
                                                                                          SHA-256:0B7D95F10632EA2EB39AC43879CD17510C8221012DAF6A5EB1A25C94BB8877F4
                                                                                          SHA-512:F1A0A764EA5EC2C316CADE9B904A7A06B47D774962EF2055E35181C2B0324082B110D2C019F069DBCCEF6010D079BE9E0B5817F69DF45F7A187AF56DA7211877
                                                                                          Malicious:false
                                                                                          Preview:............!.H....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):28672
                                                                                          Entropy (8bit):0.33890226319329847
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                          MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                          SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                          SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                          SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):406
                                                                                          Entropy (8bit):5.299280876418946
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:NXvYfYeb8rcHEZrELFUt88h/+875JfYeb8rcHEZrEZSJ:N/YfYeb8nZrExg883tJfYeb8nZrEZe
                                                                                          MD5:0DE167BA9D5A1DC719B3EDC6DE864035
                                                                                          SHA1:1788028F11AD92E96B82CBEF5BC64B59623EEB4A
                                                                                          SHA-256:E03E5D7289618EFEEBCDB338B9D94A63E7B477DB6B2D8A44C2DA02EC4D802CE7
                                                                                          SHA-512:D26AF5592A04BC9F4D727DCCC156ADA0709358D8D972FD2DD9BC1BDEA9FB235CF3864FB1EF2BA2C4689D2AC36AD1F6537A3FD30CF0B00A4DFEDD99C167269B37
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:06.426 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/25-13:12:06.427 1d58 Recovering log #3.2024/08/25-13:12:06.427 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):406
                                                                                          Entropy (8bit):5.299280876418946
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:NXvYfYeb8rcHEZrELFUt88h/+875JfYeb8rcHEZrEZSJ:N/YfYeb8nZrExg883tJfYeb8nZrEZe
                                                                                          MD5:0DE167BA9D5A1DC719B3EDC6DE864035
                                                                                          SHA1:1788028F11AD92E96B82CBEF5BC64B59623EEB4A
                                                                                          SHA-256:E03E5D7289618EFEEBCDB338B9D94A63E7B477DB6B2D8A44C2DA02EC4D802CE7
                                                                                          SHA-512:D26AF5592A04BC9F4D727DCCC156ADA0709358D8D972FD2DD9BC1BDEA9FB235CF3864FB1EF2BA2C4689D2AC36AD1F6537A3FD30CF0B00A4DFEDD99C167269B37
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:06.426 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/25-13:12:06.427 1d58 Recovering log #3.2024/08/25-13:12:06.427 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):334
                                                                                          Entropy (8bit):5.108668978966354
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdU4Rvlyq2Pwkn23oH+Tcwt8a2jMGIFUt88dU4Tm1Zmw+8dU4X9RkwOwkn23oH+k:NWvYfYeb8EFUt88Xm1/+8/5JfYeb8bJ
                                                                                          MD5:D1679A5251895FED1C2A007A0E698F58
                                                                                          SHA1:F330D75C7ADFA07AE338F826C27D5A6669299347
                                                                                          SHA-256:2B56D026DF890FBCA8BC470CCE138836966FC5419391F8DBE7F0C36CD3A5CC69
                                                                                          SHA-512:AFC35C30B61AFF2D9E5814A0D80C78447D9EB68A045C5B406C3079250313BD41277BEFB0AAA60CD82DE660E03A3A6CAC3C7C4154309992B726934E5DB8337157
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.013 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/25-13:12:02.016 1ea0 Recovering log #3.2024/08/25-13:12:02.019 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):334
                                                                                          Entropy (8bit):5.108668978966354
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdU4Rvlyq2Pwkn23oH+Tcwt8a2jMGIFUt88dU4Tm1Zmw+8dU4X9RkwOwkn23oH+k:NWvYfYeb8EFUt88Xm1/+8/5JfYeb8bJ
                                                                                          MD5:D1679A5251895FED1C2A007A0E698F58
                                                                                          SHA1:F330D75C7ADFA07AE338F826C27D5A6669299347
                                                                                          SHA-256:2B56D026DF890FBCA8BC470CCE138836966FC5419391F8DBE7F0C36CD3A5CC69
                                                                                          SHA-512:AFC35C30B61AFF2D9E5814A0D80C78447D9EB68A045C5B406C3079250313BD41277BEFB0AAA60CD82DE660E03A3A6CAC3C7C4154309992B726934E5DB8337157
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.013 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/25-13:12:02.016 1ea0 Recovering log #3.2024/08/25-13:12:02.019 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):57344
                                                                                          Entropy (8bit):0.863060653641558
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                          MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                          SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                          SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                          SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                          Category:dropped
                                                                                          Size (bytes):45056
                                                                                          Entropy (8bit):0.40293591932113104
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                                                          MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                                                          SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                                                          SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                                                          SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\01538245-1a26-4ce6-86f0-88bc97929155.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2271
                                                                                          Entropy (8bit):5.2671367009558985
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YXsvJ8seWC5sEgssrsxnfcdsH/gnsT5+HrsOYsS+H5CbZ:phckWn7354zy441
                                                                                          MD5:4934E5BC79EE7442C555EB6736A7DBBC
                                                                                          SHA1:66CB632959B26FB57AD0C7DDF3954EF5102B2ABA
                                                                                          SHA-256:D354D7E73256A74D306CF43B238EDBC6BE2A57F6B384B0A7884F055FD92B8C44
                                                                                          SHA-512:25803D708B719A84AC107A44010FCE9E3AD7865F657B0DE204C61BBF498D0566311902D159BDFAD0EF71E4E5BCB2E0A0DB99644D2D8B8DF0FF4B4E067CD1B4B7
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371671524239375","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369173127326836","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371671527332722","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371671530661307","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://www.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371671

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\09dfb8f8-91da-48c7-836d-152fad7a3f25.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):111
                                                                                          Entropy (8bit):4.718418993774295
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                          MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                          SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                          SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                          SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a37ada5-9661-470b-b735-ef22021ac606.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\551fc718-1353-476a-a10d-8c19376622d4.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e475c4e-62d4-4531-9190-4863ffb33f41.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d6bf7a2-df1b-40fa-aad9-33932b12eaf9.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):355
                                                                                          Entropy (8bit):5.473179129722269
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQc+uYzYWlBv31dB8wXwlmUUAnIMp5YTz:YWyX5Sg9vt+UAnIQc+uYcWlR7N+UAnIn
                                                                                          MD5:B4AFC66D83BC8DF26F5F1FDAB0F446C9
                                                                                          SHA1:415D023D4323832FEF913F9FDB3C53687E0838A2
                                                                                          SHA-256:699A7DD49DE1C101529C3E9A6C34D961297E265BDDE63FE36E0B98B22D78B424
                                                                                          SHA-512:1ADD754F6E6E12B1DE8837E4D0D52EB217F013A78CEC704551DA67BE09BB86E072D22F5402D493FBE0502D844F0E9E3892BC02BB7CE0FBDEC40CB57CBD4C789D
                                                                                          Malicious:false
                                                                                          Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756141991.677248,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1724605991.677254}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):1.0811340000153584
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:T2dKLopF+SawLUO1Xj8BqFMOwlPfIwRyl/WtBp5jdUZOFyPr:ige+AumwWU/BtGr
                                                                                          MD5:9AC662E5A0562B55D815ECCBB5DFEDD5
                                                                                          SHA1:EAB4B09DC5FD06DA9C058D481FB31AA1161A3173
                                                                                          SHA-256:86F53AC450511AD7E7D676DB299C52970BE385FCCAB36B9114192862AD5DB4F0
                                                                                          SHA-512:7859A4EE3739013695506E9AF5D914D250EB1478B1A1B6082312921B7C96AFF52672871AC4902ADA223691B92B987A16C022909B9EC1E9D4F390C2E151FCE87A
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):61
                                                                                          Entropy (8bit):3.926136109079379
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                          MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                          SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                          SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                          SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2c569.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):61
                                                                                          Entropy (8bit):3.926136109079379
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                          MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                          SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                          SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                          SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3aff8.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):61
                                                                                          Entropy (8bit):3.926136109079379
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                          MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                          SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                          SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                          SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                          Category:dropped
                                                                                          Size (bytes):36864
                                                                                          Entropy (8bit):1.3280111372785806
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:uIEumQv8m1ccnvS6ADo2dQF2YQ9UZc12iRVkI:uIEumQv8m1ccnvS6d282rUZcoKd
                                                                                          MD5:D6091DD27567223C00EA75848C294901
                                                                                          SHA1:DBF8B661C6E430689CBD3516DFDA003984A6BB44
                                                                                          SHA-256:D60A569E6619C99A55590832F23C8EC4D74121A24AE6D622282E45CB46724E06
                                                                                          SHA-512:310B6AD8C92A9CC3F3E7AAF13EA8D71979C83E72CB02F07A94EFE6C009422883D3EFE769180F0B1CEE5241CC6DA2053C15D72745B8513BA8E80C7BC736FC5EE8
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF29e88.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e739.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):40
                                                                                          Entropy (8bit):4.1275671571169275
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                          Malicious:false
                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):203
                                                                                          Entropy (8bit):5.4042796420747425
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                          MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                          SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                          SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                          SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                          Malicious:false
                                                                                          Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2c440.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):203
                                                                                          Entropy (8bit):5.4042796420747425
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                          MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                          SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                          SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                          SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                          Malicious:false
                                                                                          Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3bf69.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):203
                                                                                          Entropy (8bit):5.4042796420747425
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                          MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                          SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                          SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                          SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                          Malicious:false
                                                                                          Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                          Category:dropped
                                                                                          Size (bytes):36864
                                                                                          Entropy (8bit):0.36515621748816035
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                          MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                          SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                          SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                          SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e75fd460-6ce5-47ea-9585-bfff9785a223.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):40
                                                                                          Entropy (8bit):4.1275671571169275
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                          Malicious:false
                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\edf738fe-04df-4826-a377-df8f92c0304d.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):355
                                                                                          Entropy (8bit):5.46811381238876
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQc+kQq8Bv31dB8wXwlmUUAnIMp5YTV47:YWyX5Sg9vt+UAnIQc+BhR7N+UAnI/TV8
                                                                                          MD5:36350FA3A156E4056F56DB628D9359BD
                                                                                          SHA1:7C6AC2177F07C0F5A8C530967B5845F5623D3DA3
                                                                                          SHA-256:83F594B603FFEDE847257C9241364B517ADADCE43AAE222325292F1B753A0C8F
                                                                                          SHA-512:66A3ADE397B36FC4308E295A2BF9AB965ED65A44F8D5B5AF20CDBE17847E340C32266B0D5E44742E8AA9CAB981DEF03607F6F3D70BBD2921948212B66DED8092
                                                                                          Malicious:false
                                                                                          Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756141931.727662,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1724605931.727666}],"version":2}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):0.5744102022039023
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isCHIrdNG7fdjxHIXOFSY:TLiOUOq0afDdWec9sJKG7zo7J5fc
                                                                                          MD5:8B7CCBAE5FB8F1D3FDB331AED0833FB0
                                                                                          SHA1:7924CE8D7CF818F1132F1C8A047FBEEF13F18877
                                                                                          SHA-256:8029C4EAA75734867C5970AB41422A7F551EBFDF65E152C09F8A4038B17080C8
                                                                                          SHA-512:23B07F98E037ECC9BAAB37EA93264503B936CA180F4873D19944D186F3529926CBDC7A0962E7A51EADC8CEB2CA85D94BFC3C431D0068B8320C45BF24C0DDB163
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):9751
                                                                                          Entropy (8bit):4.9509983852249775
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:sVDkdBYXJ1uBb91AXaYa3eC85Th6np9/x+6M8muecUi1eAeCjr1e4zvrRl2BHQyn:sVDkdqJEmXaYa3eC80pj+FPiQAdH7a1f
                                                                                          MD5:CA641C9D5900A9F19A2022066AB15154
                                                                                          SHA1:A881EEE53983F4FCA11FA07F6A9DCE24C03BF0BD
                                                                                          SHA-256:3D431095B1995871B580DBCAD41AEA579D4DE57C6217B8340893DD39949B78C7
                                                                                          SHA-512:D46A67012B9CB194C91D23136161F470EBDD01C9FC0A0AEFFF3CE36AEF3DF7127CCE692F6B313C643152AD562E2D4DFF8DE1071AD88C9A4E46050EABA1512EB9
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31166.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):9751
                                                                                          Entropy (8bit):4.9509983852249775
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:sVDkdBYXJ1uBb91AXaYa3eC85Th6np9/x+6M8muecUi1eAeCjr1e4zvrRl2BHQyn:sVDkdqJEmXaYa3eC80pj+FPiQAdH7a1f
                                                                                          MD5:CA641C9D5900A9F19A2022066AB15154
                                                                                          SHA1:A881EEE53983F4FCA11FA07F6A9DCE24C03BF0BD
                                                                                          SHA-256:3D431095B1995871B580DBCAD41AEA579D4DE57C6217B8340893DD39949B78C7
                                                                                          SHA-512:D46A67012B9CB194C91D23136161F470EBDD01C9FC0A0AEFFF3CE36AEF3DF7127CCE692F6B313C643152AD562E2D4DFF8DE1071AD88C9A4E46050EABA1512EB9
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35073.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):9751
                                                                                          Entropy (8bit):4.9509983852249775
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:sVDkdBYXJ1uBb91AXaYa3eC85Th6np9/x+6M8muecUi1eAeCjr1e4zvrRl2BHQyn:sVDkdqJEmXaYa3eC80pj+FPiQAdH7a1f
                                                                                          MD5:CA641C9D5900A9F19A2022066AB15154
                                                                                          SHA1:A881EEE53983F4FCA11FA07F6A9DCE24C03BF0BD
                                                                                          SHA-256:3D431095B1995871B580DBCAD41AEA579D4DE57C6217B8340893DD39949B78C7
                                                                                          SHA-512:D46A67012B9CB194C91D23136161F470EBDD01C9FC0A0AEFFF3CE36AEF3DF7127CCE692F6B313C643152AD562E2D4DFF8DE1071AD88C9A4E46050EABA1512EB9
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a048.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):9751
                                                                                          Entropy (8bit):4.9509983852249775
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:sVDkdBYXJ1uBb91AXaYa3eC85Th6np9/x+6M8muecUi1eAeCjr1e4zvrRl2BHQyn:sVDkdqJEmXaYa3eC80pj+FPiQAdH7a1f
                                                                                          MD5:CA641C9D5900A9F19A2022066AB15154
                                                                                          SHA1:A881EEE53983F4FCA11FA07F6A9DCE24C03BF0BD
                                                                                          SHA-256:3D431095B1995871B580DBCAD41AEA579D4DE57C6217B8340893DD39949B78C7
                                                                                          SHA-512:D46A67012B9CB194C91D23136161F470EBDD01C9FC0A0AEFFF3CE36AEF3DF7127CCE692F6B313C643152AD562E2D4DFF8DE1071AD88C9A4E46050EABA1512EB9
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):33
                                                                                          Entropy (8bit):4.051821770808046
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                          MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                          SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                          SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                          SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                          Malicious:false
                                                                                          Preview:{"preferred_apps":[],"version":1}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24853
                                                                                          Entropy (8bit):5.56592859812683
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:DhuNDQWPw2f7y8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs1G10rwLpttuw:DhuNDQWPw2f7yu1jadM1trtP
                                                                                          MD5:9131FD1922500EE5BEE554C22990B99C
                                                                                          SHA1:3985C53D38607DCDFD2B8E9AEE9A06C8F83379F0
                                                                                          SHA-256:9998653AA260B4F1C34841BAB8027F66F2052D5C1461348FE3B66480A93C544A
                                                                                          SHA-512:5F509287A010DDB70B23AC92DDD51ED80E7EDD661EB3602F92A6A8603A9286A5ED38E8E5AA5CD1F00015D2B0B6DED913CF93B35887FEB0E823C08966BF2BCC61
                                                                                          Malicious:false
                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369079521268835","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369079521268835","location":5,"ma

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF304b4.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24853
                                                                                          Entropy (8bit):5.56592859812683
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:DhuNDQWPw2f7y8F1+UoAYDCx9Tuqh0VfUC9xbog/OVs1G10rwLpttuw:DhuNDQWPw2f7yu1jadM1trtP
                                                                                          MD5:9131FD1922500EE5BEE554C22990B99C
                                                                                          SHA1:3985C53D38607DCDFD2B8E9AEE9A06C8F83379F0
                                                                                          SHA-256:9998653AA260B4F1C34841BAB8027F66F2052D5C1461348FE3B66480A93C544A
                                                                                          SHA-512:5F509287A010DDB70B23AC92DDD51ED80E7EDD661EB3602F92A6A8603A9286A5ED38E8E5AA5CD1F00015D2B0B6DED913CF93B35887FEB0E823C08966BF2BCC61
                                                                                          Malicious:false
                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369079521268835","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369079521268835","location":5,"ma

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):364
                                                                                          Entropy (8bit):4.0440553154235515
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:S85aEFljljljljljljlIW/laDjGrGw+CA5EEE:S+a8ljljljljljljlLUWt+CA
                                                                                          MD5:371F220610C226DB6EEBAEF23E70A143
                                                                                          SHA1:7B16A382B3F871434BBB64C977135D0BDFBF45E6
                                                                                          SHA-256:98145AC89D09732BE4C6A46BBBAB9F44FCF1095B4A251F2664F1EA7DA45B39B2
                                                                                          SHA-512:083D47787FC6C87F372C533C4F334FE4E5A6026E0DCC1F2C7113A6B702EC0B92671E5AB97A83E6E6B5526897F8BC82A691C04804F6033AD4E680FE2360C958D7
                                                                                          Malicious:false
                                                                                          Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f..................j................next-map-id.1.Knamespace-692a7ead_d8b8_4eb0_9dec_f2091729b3a1-https://accounts.google.com/.0V.e................V.e................V.e................V.e................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):322
                                                                                          Entropy (8bit):5.128087740779564
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUSyq2Pwkn23oH+TcwtrQMxIFUt88dUT1Zmw+8dUO2WRkwOwkn23oH+TcwtrQMT:NAvYfYebCFUt88s1/+8p2C5JfYebtJ
                                                                                          MD5:36946BBA716C932EE97707EC92AE21BB
                                                                                          SHA1:AD18A0C55943622715F6863FDA3C66576FD6A73B
                                                                                          SHA-256:AB7898DBB61061C7FCC7AC41BC2B8345E6CA78AE3E073F295AE4E2D0C130B356
                                                                                          SHA-512:C0BBF564C74FDE9475AFB4FDC31DCB4666B7DDAB942498745EE7A07F37AC7126A7BD39E01BE98DC21626E334390FF4063806FC610839E12874DB0C4593890E7F
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.984 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/25-13:12:01.989 1ea0 Recovering log #3.2024/08/25-13:12:01.997 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):322
                                                                                          Entropy (8bit):5.128087740779564
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUSyq2Pwkn23oH+TcwtrQMxIFUt88dUT1Zmw+8dUO2WRkwOwkn23oH+TcwtrQMT:NAvYfYebCFUt88s1/+8p2C5JfYebtJ
                                                                                          MD5:36946BBA716C932EE97707EC92AE21BB
                                                                                          SHA1:AD18A0C55943622715F6863FDA3C66576FD6A73B
                                                                                          SHA-256:AB7898DBB61061C7FCC7AC41BC2B8345E6CA78AE3E073F295AE4E2D0C130B356
                                                                                          SHA-512:C0BBF564C74FDE9475AFB4FDC31DCB4666B7DDAB942498745EE7A07F37AC7126A7BD39E01BE98DC21626E334390FF4063806FC610839E12874DB0C4593890E7F
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.984 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/25-13:12:01.989 1ea0 Recovering log #3.2024/08/25-13:12:01.997 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13369079523762195

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):7469
                                                                                          Entropy (8bit):4.017518410858869
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:3wphpC3P64NA1U3P64N27eQAOR3P64N7V/n:g864NAu64NfE64N7V/
                                                                                          MD5:8FFFFD26D8A1A588CBB619D7D3444719
                                                                                          SHA1:F69D05A86CDD76598F9C870F87007D1D12E54469
                                                                                          SHA-256:BCCE604332A2ABD03D5DB54ADE5424F39AA7B00F38FC164A2DB3777A1F8F7B7B
                                                                                          SHA-512:986C17B9BDEA89BE5E3DB76475FCAEEF8A945606D03B4E887F5E5BCB914C44686F5AE39C809BE1DAC72D5AC7F473E9F7A75C7DB4FC76C214A574BA571D9E26F7
                                                                                          Malicious:false
                                                                                          Preview:SNSS........@.I............@.I......".@.I............@.I........@.I........@.I........@.I....!...@.I................................@.I.@.I1..,....@.I$...692a7ead_d8b8_4eb0_9dec_f2091729b3a1....@.I........@.I.....X..........@.I....@.I........................@.I....................5..0....@.I&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}......@.I........@.I...........................@.I............@.I....>...https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd&ifkv=Ab5oB3q-UFL7P8pX6BplHHaIdcjnFsqNJUHfFCgTIYtCXOkrNgbliJmU_Y3s9tSER-POmdeRb--ndg&service=accountsettings&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-601637896%3A1724605925341632&ddm=0......S.i.g.n. .i.n. .-. .G.o.o.g.l.e. .A.c.c.o.u.n.t.s...L...H...!...@...................................................................................................... ..... ..................................P...................................................>...h

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):0.44194574462308833
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                          MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                          SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                          SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                          SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):350
                                                                                          Entropy (8bit):5.157728212235436
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdU8N9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88dUQYFJZmw+8dUca9VkwOwkn23oH+Q:N7OvYfYebIhHh2FUt88nY//+8bk5JfYz
                                                                                          MD5:476E49C24C074C2EC68A969BA3906675
                                                                                          SHA1:A92B4E0B9C708DE19E60ADF6EAE974FBC55A1C3E
                                                                                          SHA-256:83492287E3B03F6A12650BD0CF9695591B908B364FA6EECE41B6BB655490A75F
                                                                                          SHA-512:1D3686915D31321245349743D60FE37430FE7CD2A1794799573E173F17B8FD72E3C5B2C0D709F4084CAD5EA8A11E7DECB8DA5396C01A87DF4DC46A029320AAAC
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.342 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/25-13:12:01.343 1d88 Recovering log #3.2024/08/25-13:12:01.347 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):350
                                                                                          Entropy (8bit):5.157728212235436
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdU8N9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88dUQYFJZmw+8dUca9VkwOwkn23oH+Q:N7OvYfYebIhHh2FUt88nY//+8bk5JfYz
                                                                                          MD5:476E49C24C074C2EC68A969BA3906675
                                                                                          SHA1:A92B4E0B9C708DE19E60ADF6EAE974FBC55A1C3E
                                                                                          SHA-256:83492287E3B03F6A12650BD0CF9695591B908B364FA6EECE41B6BB655490A75F
                                                                                          SHA-512:1D3686915D31321245349743D60FE37430FE7CD2A1794799573E173F17B8FD72E3C5B2C0D709F4084CAD5EA8A11E7DECB8DA5396C01A87DF4DC46A029320AAAC
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.342 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/25-13:12:01.343 1d88 Recovering log #3.2024/08/25-13:12:01.347 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):8.280239615765425E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                          MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                          SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                          SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                          SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):524656
                                                                                          Entropy (8bit):5.027445846313988E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsulNnaq:LsWaq
                                                                                          MD5:F3CC7A845748206B5F4DF89B872E2621
                                                                                          SHA1:B84EA6E3446D80B8B07454C22603C5C06E0B7E45
                                                                                          SHA-256:640B74437F7877165307DDF92B7011A7792E1E42F620C6DB96B6631B6F967482
                                                                                          SHA-512:B6563E0ED6D80773155571FB5185ADAC4B649F572F654D0F0A29969ED5DB7652E7DFF8F1A409EB7460D42D2D43E5B4002FF30E1227CC2F86EE7E8E39EE5A3FC7
                                                                                          Malicious:false
                                                                                          Preview:........................................>.5d../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):262512
                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsNlL+Bllll:Ls38X
                                                                                          MD5:706CF995494C4672DF6C6EA9BD84D40E
                                                                                          SHA1:14AC9403D4D1ABA1677391D65CA6C0F809AE0C99
                                                                                          SHA-256:D4C7BCAD4983577AC350D680D43E30467C927094552D7F28D830B3C995D9532E
                                                                                          SHA-512:D65E7075BFD5354B95F8BA22775A9C91ADE80DD3387B709AACF664B472674BF8B7CA537DF63731E238A0BD65314DD1832CECE1C0C26FE8AD34BA295F0BE343E1
                                                                                          Malicious:false
                                                                                          Preview:...........................................c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):0.0012471779557650352
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                          MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                          SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                          SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                          SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):432
                                                                                          Entropy (8bit):5.211363288260334
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:NNXAvYfYebvqBQFUt88+1/+8V5JfYebvqBvJ:NNXyYfYebvZg88+7HJfYebvk
                                                                                          MD5:DAEFBBFF567E5DDFB77D4BEE3EB8B005
                                                                                          SHA1:2D387633A2CD8D1FB8E61CC70FBF9D9C2C32D9AF
                                                                                          SHA-256:1D7B5C16D2350B833FC29DFE99599688989F524AA3C71BF46453C25169709658
                                                                                          SHA-512:046EE9CA157A9605EE4407BDA1D3EEC9DFD6210CBBB9405AA42E8495A9340C4DCAB6AA32F4AC6DBBE509C1DD63D415D2C292DE73C40C555D9C63A3EE7F1A7D63
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.439 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/25-13:12:02.441 1ea0 Recovering log #3.2024/08/25-13:12:02.444 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):432
                                                                                          Entropy (8bit):5.211363288260334
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:NNXAvYfYebvqBQFUt88+1/+8V5JfYebvqBvJ:NNXyYfYebvZg88+7HJfYebvk
                                                                                          MD5:DAEFBBFF567E5DDFB77D4BEE3EB8B005
                                                                                          SHA1:2D387633A2CD8D1FB8E61CC70FBF9D9C2C32D9AF
                                                                                          SHA-256:1D7B5C16D2350B833FC29DFE99599688989F524AA3C71BF46453C25169709658
                                                                                          SHA-512:046EE9CA157A9605EE4407BDA1D3EEC9DFD6210CBBB9405AA42E8495A9340C4DCAB6AA32F4AC6DBBE509C1DD63D415D2C292DE73C40C555D9C63A3EE7F1A7D63
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:02.439 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/25-13:12:02.441 1ea0 Recovering log #3.2024/08/25-13:12:02.444 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4cf9840d-bf76-42ba-bfa2-ef98b64da04b.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):40
                                                                                          Entropy (8bit):4.1275671571169275
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                          Malicious:false
                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5f561730-3472-4587-96ec-18c1e4c1a749.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6ab55baf-1359-411d-8e64-9effef17491c.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):111
                                                                                          Entropy (8bit):4.718418993774295
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                          MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                          SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                          SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                          SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):193
                                                                                          Entropy (8bit):4.864047146590611
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                          MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                          SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                          SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                          SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3bba0.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):193
                                                                                          Entropy (8bit):4.864047146590611
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                          MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                          SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                          SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                          SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                          Malicious:false
                                                                                          Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                          Category:dropped
                                                                                          Size (bytes):36864
                                                                                          Entropy (8bit):0.555790634850688
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                          MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                          SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                          SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                          SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e739.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):40
                                                                                          Entropy (8bit):4.1275671571169275
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                          MD5:20D4B8FA017A12A108C87F540836E250
                                                                                          SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                          SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                          SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                          Malicious:false
                                                                                          Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                          Category:dropped
                                                                                          Size (bytes):36864
                                                                                          Entropy (8bit):0.36515621748816035
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                          MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                          SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                          SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                          SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d96d3771-b7f4-4521-afab-12883c9616ff.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2
                                                                                          Entropy (8bit):1.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:H:H
                                                                                          MD5:D751713988987E9331980363E24189CE
                                                                                          SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                          SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                          SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                          Malicious:false
                                                                                          Preview:[]

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):80
                                                                                          Entropy (8bit):3.4921535629071894
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                          MD5:69449520FD9C139C534E2970342C6BD8
                                                                                          SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                          SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                          SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                          Malicious:false
                                                                                          Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):420
                                                                                          Entropy (8bit):5.212829921046059
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:N2vYfYebvqBZFUt88K1/+85vz5JfYebvqBaJ:NUYfYebvyg88K7jJfYebvL
                                                                                          MD5:B1F0DD7E63561752C1E40A5B536E9C55
                                                                                          SHA1:ABB184F5AFD82943998538CF1AD5B41A5880FBD2
                                                                                          SHA-256:C1C06A8899D196676E0BD7CE67441D6AF46880E3893AAD6552D3E82631EE61D3
                                                                                          SHA-512:3A3207EC33E2A74A3E0C84C7AB38A55815FB2844F867F5B0407001848D690781F3AF6E4FCFC714CADFA582BE139E6A8DD2DD0D4913AEAF5379443FB557FCD342
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:21.434 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/25-13:12:21.435 1ea0 Recovering log #3.2024/08/25-13:12:21.438 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):420
                                                                                          Entropy (8bit):5.212829921046059
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:N2vYfYebvqBZFUt88K1/+85vz5JfYebvqBaJ:NUYfYebvyg88K7jJfYebvL
                                                                                          MD5:B1F0DD7E63561752C1E40A5B536E9C55
                                                                                          SHA1:ABB184F5AFD82943998538CF1AD5B41A5880FBD2
                                                                                          SHA-256:C1C06A8899D196676E0BD7CE67441D6AF46880E3893AAD6552D3E82631EE61D3
                                                                                          SHA-512:3A3207EC33E2A74A3E0C84C7AB38A55815FB2844F867F5B0407001848D690781F3AF6E4FCFC714CADFA582BE139E6A8DD2DD0D4913AEAF5379443FB557FCD342
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:21.434 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/25-13:12:21.435 1ea0 Recovering log #3.2024/08/25-13:12:21.438 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):326
                                                                                          Entropy (8bit):5.175954805754338
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUkAq2Pwkn23oH+TcwtpIFUt88dUkhZmw+8dUjkwOwkn23oH+Tcwta/WLJ:NFAvYfYebmFUt88Fh/+8O5JfYebaUJ
                                                                                          MD5:E783863653F4C0DD874D333F7C9983B3
                                                                                          SHA1:D4895550EE3F79FFC4A7D81B6B22EA2AE1F29361
                                                                                          SHA-256:ED86BFEA337C7C0E162AAE678229E3142DFA91E6DD84D174BB84DCC1DD491C6C
                                                                                          SHA-512:746FC6BB6780369CC5ACADF612BB329E611546BB94AF0BBDF5A387CB1690248FE28D177A32C54F031503D20E6666B8BCC7297FEF346844AC8A16572830004235
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.325 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/25-13:12:01.325 1da0 Recovering log #3.2024/08/25-13:12:01.326 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):326
                                                                                          Entropy (8bit):5.175954805754338
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUkAq2Pwkn23oH+TcwtpIFUt88dUkhZmw+8dUjkwOwkn23oH+Tcwta/WLJ:NFAvYfYebmFUt88Fh/+8O5JfYebaUJ
                                                                                          MD5:E783863653F4C0DD874D333F7C9983B3
                                                                                          SHA1:D4895550EE3F79FFC4A7D81B6B22EA2AE1F29361
                                                                                          SHA-256:ED86BFEA337C7C0E162AAE678229E3142DFA91E6DD84D174BB84DCC1DD491C6C
                                                                                          SHA-512:746FC6BB6780369CC5ACADF612BB329E611546BB94AF0BBDF5A387CB1690248FE28D177A32C54F031503D20E6666B8BCC7297FEF346844AC8A16572830004235
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.325 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/25-13:12:01.325 1da0 Recovering log #3.2024/08/25-13:12:01.326 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):28672
                                                                                          Entropy (8bit):0.26707851465859517
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                          MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                          SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                          SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                          SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):131072
                                                                                          Entropy (8bit):0.005582420312713277
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:ImtVx//l/5pxvPyE/lA+s///:IiVt/iEtbs//
                                                                                          MD5:EF877FDB510AC7F1811184A0CEB224B8
                                                                                          SHA1:892AD22AEFEDD4EDB35672E37644507F13D187C0
                                                                                          SHA-256:70322ADAB5516238A34FBE4DD7DE9A594BA8E0D3E5573EEB58121CC544E264C1
                                                                                          SHA-512:1D0DC2F2EDCDE9A251F0FF497411BCA51B9A3849471C15DE53FBA0764862B443EA78ECB557C880F6229B48608A1AF4B838639777EA03A35BB975A7948FC99C46
                                                                                          Malicious:false
                                                                                          Preview:VLnk.....?.........u.6Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
                                                                                          Category:dropped
                                                                                          Size (bytes):184320
                                                                                          Entropy (8bit):1.0668623208637407
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:QSqzWMMUfTnQnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYWw1n6:QrzWMffsnzkkqtXnTK+hNH+5EVumq
                                                                                          MD5:A842D0C1EBEDD96972005659BAC06E1F
                                                                                          SHA1:5A94955FB9F1BF9175614EB51497DACA4F725192
                                                                                          SHA-256:8B2E4ABCC67466DB47560B83BFCE1E6010CF506D36B992A13DB52016EBA0375D
                                                                                          SHA-512:0A434C50FFED6F10807BAC1AEC2FE3701A6BD466238F17801FB8F639619102CCB7C37B4437B617FF6537306C6EDC6466FBDEE626A72B28D12CB0E4660C3CAF80
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
                                                                                          Category:dropped
                                                                                          Size (bytes):14336
                                                                                          Entropy (8bit):1.4149291776229334
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:uOK3tjkSdj5IUltGhp22iSBgk2Ryx+uUwGaQ2Ryx+uUMxj/:PtSjGhp22iS4U+ubPU+uD
                                                                                          MD5:02145E0F76050C21C78E93C8440ADC43
                                                                                          SHA1:7842D284990A0F608F534EA5F4ED7B6566DD4B6C
                                                                                          SHA-256:F134923A69A66EC1572217B6E4B674CF19C825789AD199B62B703CFF307CF45D
                                                                                          SHA-512:AC2F7E0AAA45DB0685B45B551B311AB2450243E062010224BC2E0051CEA17F5A00574B94D2B78E07B2A5796A11355AF496CC1B81F045BBDD96295D642B6E27B7
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):40960
                                                                                          Entropy (8bit):0.41235120905181716
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
                                                                                          MD5:981F351994975A68A0DD3ECE5E889FD0
                                                                                          SHA1:080D3386290A14A68FCE07709A572AF98097C52D
                                                                                          SHA-256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
                                                                                          SHA-512:C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aa2dbc4d-ca2b-450d-bbc9-4e9639e162d0.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):11099
                                                                                          Entropy (8bit):5.170446819131432
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:sVDkdqJEmXors8UiYa3eC80pj+FPiQAHLzW7a1f:sVDpJEmXb8U0pUqQ+LzWQ
                                                                                          MD5:16B1EA2125730E6D3343C99F2D7FB508
                                                                                          SHA1:3430793A8B944B6EBA55B26B53B2939AD6E1E7DE
                                                                                          SHA-256:8F8EACE49A4A0216B875163179DAFA855815DC22188505D56EADB324B6F16008
                                                                                          SHA-512:3EAB547AE0D99B0CDB14F10F08C46C06992907829FF11B60F09393022449E787E7B57E700594BB2BC673ABF3917C834DA18F34CFF9613036464C64A7979F5A37
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\af264a10-af64-48df-a5bd-e56c351f51ca.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:very short file (no magic)
                                                                                          Category:dropped
                                                                                          Size (bytes):1
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:L:L
                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                          Malicious:false
                                                                                          Preview:.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):11755
                                                                                          Entropy (8bit):5.190465908239046
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                          MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                          SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                          SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                          SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                          Malicious:false
                                                                                          Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c1ba1363-fb4a-4668-aa25-4c2409eb6edc.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):10989
                                                                                          Entropy (8bit):5.172060877150331
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:sVDkdqJEmXors8UiYa3eC80pj+FPiQAMzH7a1f:sVDpJEmXb8U0pUqQFzHQ
                                                                                          MD5:66EE5C89785F680E92EA7375E9F98CF6
                                                                                          SHA1:360ABE24428E5FB358812164B8FB68855FC86098
                                                                                          SHA-256:C337ECBC377DE6E798A98BBE196519630D9D4C80A166E34BF41D848E1F1E2F46
                                                                                          SHA-512:0B7A0FF77E1F752754D54CC3C347ADAFBA513C725CC69EC173CCDB817F050543F5925B3BB343082745EBD5A4BB8FBB8EFDBC57597CAE8206B8E080A7FDE90CD8
                                                                                          Malicious:false
                                                                                          Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369079521932775","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0"

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                          Category:dropped
                                                                                          Size (bytes):28672
                                                                                          Entropy (8bit):0.3410017321959524
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                          MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                          SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                          SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                          SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e7039afe-21e7-44cf-aded-7c7cb4376a52.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):30210
                                                                                          Entropy (8bit):5.566381422759118
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:DhuNM87pLGLvtQWPw2fUy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOd/1G10rwsptt2:DhuNMgcvtQWPw2fUyu1jabd/M1tqt2
                                                                                          MD5:0266DD71A247BBE61484CAC826F511B0
                                                                                          SHA1:0B322D506B5155AD8A9952CBBEF6514844F98B57
                                                                                          SHA-256:62A29B3376984970468301B93F94E8BED2BD490CE410E8B7752685373ECEC85F
                                                                                          SHA-512:40C93E6CF599C154867D4B55124C467AF18BCA7028192389D67EE7DE90B5C1CE216DE963A0F1DC3D2123D61D34A798916BBB50CACF50576F57A79849C06838DA
                                                                                          Malicious:false
                                                                                          Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369079521268835","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369079521268835","location":5,"ma

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                          Category:dropped
                                                                                          Size (bytes):16384
                                                                                          Entropy (8bit):0.35226517389931394
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                          MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                          SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                          SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                          SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):32768
                                                                                          Entropy (8bit):0.09708729526240971
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:G9l/jwKAkmpol/jwKAkmxl9XHl/Vl/Unkl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vs:CtTAkPtTAk8FnnnnnnnnnnnnnnpEo
                                                                                          MD5:C722D7187F73BEC251783CF7C39A8873
                                                                                          SHA1:F9D5D6847EE10024BD75E2D96C8700A325AFE0EA
                                                                                          SHA-256:99B30373C1A42FC3DD41AC740CB41CD8C61BA63418C48041476DA8422214BAE6
                                                                                          SHA-512:C781FF6B628DF6978C8917CB8DC67B86D6CCB7BACC4E6393122A43F4F471406025BDC4D72EBA18BE250B262BDFB8BFA793EEBC2A13264FF335CCD60D65855B50
                                                                                          Malicious:false
                                                                                          Preview:..-.............H.........p.d.......PBo%A.M...;..-.............H.........p.d.......PBo%A.M...;........D...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite Write-Ahead Log, version 3007000
                                                                                          Category:dropped
                                                                                          Size (bytes):296672
                                                                                          Entropy (8bit):1.0148633144472157
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:wHgn52AhXvg3seKGIBSYl/C4KagaOls4eO:wHb+fg8jNE6apxvsxO
                                                                                          MD5:E5C1C5B938775232173B5E17E411F929
                                                                                          SHA1:1C3CA32356652078EF00971FCA8EF215E1ECBF15
                                                                                          SHA-256:2A8142C34908654343D27231900856D78E415BE98B7DB6606E4A741E6A8B4FA2
                                                                                          SHA-512:354B6B7A64A253CF8E4CAE3E01DD53FA02B497B7E1ACB8E2F5D5A8C2069A04B6BFFF4AF72E672D87943E162A1F1A99836BA6CB29A2F0CE9E4D7A54CAFBA51C46
                                                                                          Malicious:false
                                                                                          Preview:7....-..............PBo%...................PBo%.....h:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:modified
                                                                                          Size (bytes):250
                                                                                          Entropy (8bit):3.6968918782369986
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:VVXntjQPEnjQvoll3seGKT9rcQ6x/tFtlTxotlTxotlTxotlTxotlTxotlTxotl:/XntM+2oll3sedhO/tFuuuuuu
                                                                                          MD5:D1B92A7E2222C451C69A3E56FA9157B5
                                                                                          SHA1:E473E77F434888B4AB312E6ED882655F6EF30DBA
                                                                                          SHA-256:4A9C632A39E5CAD665D38852C0583A628BC7DC7C9C4790F89819BE207CA5CFAB
                                                                                          SHA-512:247EED8E58575BA91B81E464491B9CA58DC425A36C7F300C05D4D1BE9BE4E5964FB35BCF421F05B6E1261D23B25FAB199E08E10D4CAD749981CB306A1CB65484
                                                                                          Malicious:false
                                                                                          Preview:A..r.................20_1_1...1.,U.................20_1_1...1. Z.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):281
                                                                                          Entropy (8bit):5.242188628957723
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUCTEmhq1wkn23oH+Tcwtfrl2KLlLdUQOq2Pwkn23oH+TcwtfrK+IFUv:Nlo01fYeb1L1LOvYfYeb23FUv
                                                                                          MD5:5E526D82F8A9FB7465119B0C93B29805
                                                                                          SHA1:599D0935791A9696125FCA46625E91B83D01AA81
                                                                                          SHA-256:E72E7C7E23A66A117EAC1A2755DC27E261EB22C9D666D8B46D0C471438268872
                                                                                          SHA-512:304544FFA0ED5DCFDBEAD66C2B7133A4EBA0D1C7C4C0C90CB6C65176A85B751F10A7A2484FD72AF82D8AFF182B7CC824FCA522DAB89415ABAAECBCFE1A0E50DD
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.956 1d60 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/25-13:12:01.968 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):617
                                                                                          Entropy (8bit):3.9313873110156563
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtypD3RUovhC+lvBOL0
                                                                                          MD5:EB91BD5C0F483A005885C30EEB062E48
                                                                                          SHA1:6D283965A60B8153076F484F62BB93032B572C79
                                                                                          SHA-256:B5DCFA3A5B1E739BB983A6566F395343653256D75B10E1DF55E6D254B4ED01E4
                                                                                          SHA-512:8563A5E55E2CC36742EA06D8074143571E5DB3783C4C17BD89CDD66A99816979BDB95C23AC6759EB3081B6499B1F34F51A437268F145F1A7D69C17F940C08609
                                                                                          Malicious:false
                                                                                          Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.....

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):16
                                                                                          Entropy (8bit):3.2743974703476995
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                          MD5:46295CAC801E5D4857D09837238A6394
                                                                                          SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                          SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                          SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                          Malicious:false
                                                                                          Preview:MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):299
                                                                                          Entropy (8bit):5.187315151057139
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:NdUEQ7B1wkn23oH+Tcwtfrzs52KLlLdUCPM+q2Pwkn23oH+TcwtfrzAdIFUv:NvfYebs9L1lPM+vYfYeb9FUv
                                                                                          MD5:326478C72CBB5D8C6C0A35D50B79ABCB
                                                                                          SHA1:B438312FF7308EF52EC7AE8929575BC6A0EA0611
                                                                                          SHA-256:09F37BD9E6B0FDB8FC6F765550CF8A4000388014A359089351D177E2C8348EFE
                                                                                          SHA-512:25320331C42F12E7DA618D3598CEB54ADC21DDC356C65A97E04146DB3C97CD141FA4DF07DBAB578A7BC0FB6A04FB14654FF2498E1EEE1593561E8EA7C43D5243
                                                                                          Malicious:false
                                                                                          Preview:2024/08/25-13:12:01.935 1d8c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/25-13:12:01.951 1d8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):41
                                                                                          Entropy (8bit):4.704993772857998
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                          MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                          SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                          SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                          SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                          Malicious:false
                                                                                          Preview:.|.."....leveldb.BytewiseComparator......

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):8.280239615765425E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                          MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                          SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                          SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                          SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):262512
                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsNljwl:Ls3jQ
                                                                                          MD5:5E7674E290391B4FA195B44E76524276
                                                                                          SHA1:D4E0A317CD42D8D7DF29C84ED93C0AD5A9DE941F
                                                                                          SHA-256:E6A006A15F5CF9EAD6779427F1818DE1FC6C3E6D04913B058345365148164FE7
                                                                                          SHA-512:B9B0FCF3EA37CBCE58FC900A714CEF2A99650E98BC16A093C2D9495705529133914BEDC8C607E8559B3F2743BA486B5BB1CA7AF3A598D2ECFD3078C840F55ACD
                                                                                          Malicious:false
                                                                                          Preview:..........................................c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):8.280239615765425E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                          MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                          SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                          SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                          SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):262512
                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsNlE0+lll:Ls3ot
                                                                                          MD5:26E1FAD6FED3F05EFF6973DBED8270AF
                                                                                          SHA1:7977B65CC79D8A84BFF7A9B092961A39BF3F07E5
                                                                                          SHA-256:20D4A654C3655247FE1609594DD2B676DFD227B5982970ECE129E785371D0858
                                                                                          SHA-512:EF242FACD683E5A15A824A16E1F116E2A8ADC2BF8F81478DDCB1767C45C07102F456C99AB5E09AFEFE4937BA17C508E7F356C3FC1C72C1B2899FFD52C3E7FD33
                                                                                          Malicious:false
                                                                                          Preview:...........................................c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):120
                                                                                          Entropy (8bit):3.32524464792714
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                          MD5:A397E5983D4A1619E36143B4D804B870
                                                                                          SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                          SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                          SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                          Malicious:false
                                                                                          Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):13
                                                                                          Entropy (8bit):2.7192945256669794
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:NYLFRQI:ap2I
                                                                                          MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                          SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                          SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                          SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                          Malicious:false
                                                                                          Preview:117.0.2045.47

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF289e7.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28a44.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28f26.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28f46.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b617.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d056.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d0e2.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d102.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f013.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f051.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39fcb.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c6db.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fafb.TMP (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
                                                                                          Category:dropped
                                                                                          Size (bytes):20480
                                                                                          Entropy (8bit):0.5963118027796015
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
                                                                                          MD5:48A6A0713B06707BC2FE9A0F381748D3
                                                                                          SHA1:043A614CFEF749A49837F19F627B9D6B73F15039
                                                                                          SHA-256:2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
                                                                                          SHA-512:4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
                                                                                          Malicious:false
                                                                                          Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.01057775872642915
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsFl:/F
                                                                                          MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                          SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                          SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                          SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                          Malicious:false
                                                                                          Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):270336
                                                                                          Entropy (8bit):8.280239615765425E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                          MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                          SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                          SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                          SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.011852361981932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsHlDll:/H
                                                                                          MD5:0962291D6D367570BEE5454721C17E11
                                                                                          SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                          SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                          SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):8192
                                                                                          Entropy (8bit):0.012340643231932763
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:MsGl3ll:/y
                                                                                          MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                          SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                          SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                          SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                          Malicious:false
                                                                                          Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                          Category:dropped
                                                                                          Size (bytes):262512
                                                                                          Entropy (8bit):9.553120663130604E-4
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:LsNl1+aul:Ls31+R
                                                                                          MD5:342DC0F0BBD1372E1124128AEC976055
                                                                                          SHA1:DFAE5E2A1866B579DA2166539620E98F79567FF5
                                                                                          SHA-256:E81F486D7D0B7D6F76D79B39225E3DD1E209B08BFAC8B81CBE117F7F59B3DBDF
                                                                                          SHA-512:7F73731BDA952F2613E725E0A2DEA1F27555A99A7894A75163C4D8BA944B86F9060DD658E03D42EA6CAA46EE85D1CC9DB7D36F94461CE96B70C2D246B9DACBF8
                                                                                          Malicious:false
                                                                                          Preview:.........................................'.c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):47
                                                                                          Entropy (8bit):4.3818353308528755
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                          MD5:48324111147DECC23AC222A361873FC5
                                                                                          SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                          SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                          SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                          Malicious:false
                                                                                          Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):35
                                                                                          Entropy (8bit):4.014438730983427
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                          MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                          SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                          SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                          SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                          Malicious:false
                                                                                          Preview:{"forceServiceDetermination":false}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):29
                                                                                          Entropy (8bit):3.922828737239167
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:2NGw+K+:fwZ+
                                                                                          MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                          SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                          SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                          SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                          Malicious:false
                                                                                          Preview:customSynchronousLookupUris_0

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):35302
                                                                                          Entropy (8bit):7.99333285466604
                                                                                          Encrypted:true
                                                                                          SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                          MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                          SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                          SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                          SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                          Malicious:false
                                                                                          Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):18
                                                                                          Entropy (8bit):3.5724312513221195
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                          MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                          SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                          SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                          SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                          Malicious:false
                                                                                          Preview:edgeSettings_2.0-0

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3581
                                                                                          Entropy (8bit):4.459693941095613
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                          MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                          SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                          SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                          SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                          Malicious:false
                                                                                          Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):47
                                                                                          Entropy (8bit):4.493433469104717
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                          MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                          SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                          SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                          SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                          Malicious:false
                                                                                          Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):35302
                                                                                          Entropy (8bit):7.99333285466604
                                                                                          Encrypted:true
                                                                                          SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                          MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                          SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                          SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                          SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                          Malicious:false
                                                                                          Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):50
                                                                                          Entropy (8bit):3.9904355005135823
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                          MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                          SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                          SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                          SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                          Malicious:false
                                                                                          Preview:topTraffic_170540185939602997400506234197983529371

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):575056
                                                                                          Entropy (8bit):7.999649474060713
                                                                                          Encrypted:true
                                                                                          SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                          MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                          SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                          SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                          SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                          Malicious:false
                                                                                          Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):86
                                                                                          Entropy (8bit):4.389669793590032
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                                                          MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                                                          SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                                                          SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                                                          SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                                                          Malicious:false
                                                                                          Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a9d41e0b-bcc2-49ac-99fd-e90c5283f0e9.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):6820
                                                                                          Entropy (8bit):5.794059996974251
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:iaqkHfJxv5ih/cI9URLl8RotoQMFVvlwhde4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:akByeiRU7h/6qRAq1k8SPxVLZ7VTiq
                                                                                          MD5:9DFA110A3EDA3A2ED248789C9766F706
                                                                                          SHA1:D0C2752B24F7C1576CC5FEA999D022EC2B1A1A87
                                                                                          SHA-256:9D5BCD38392001545EC5493A81B2D5B1ED0EDCE74AA68F4D35703F6EBA0D1075
                                                                                          SHA-512:2BCDFD2E19FCF4A455967AF137BF642B98B1192F48FE44D28B57B417DCB1C6BEDBD84CF6162C8A01401F77EF0C02073602C3D784CEB5CC95B411B23D81EA1DF2
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD9GU86SDBkRpJLTcjdH95wEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAeE5qYwSCYv0/NgVWFRvK7wleHkkafifGeYANgkdy6UwAAAAA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c79f862f-e9d8-445e-815f-fc72fd75d7ba.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):8321
                                                                                          Entropy (8bit):5.7888046476919985
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:fsNwBkeiRUljLjGkI96qRAq1k8SPxVLZ7VTiQ:fsNwEqj3VI96q3QxVNZTiQ
                                                                                          MD5:78A074483ABAB1EFA2CB7E315E1B6178
                                                                                          SHA1:51EBC3A804B39CE34B9FCBB9DFE16515286AA780
                                                                                          SHA-256:A297D447455C848FFF9FCD641379DC550FC30739BB8F96EA911529127F9FB020
                                                                                          SHA-512:83FB2DBF97CEE59CA8BA827C6D6852FE02A3CA3782817B21EE4DAA61E5DCB11FF7E5259489CE21478688D29E13A57F8CD21E9F2215125D7A77C14E948264F074
                                                                                          Malicious:false
                                                                                          Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                          C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edaacc5e-23fd-4a2a-bfc9-7de5ddbedcfa.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):25144
                                                                                          Entropy (8bit):6.03086405766234
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:nM7X2zt1jKYqHkZeJkhDV7TUJYg1VIX4R836kJt6+:nMSzvKYqsukz7T536ct6+
                                                                                          MD5:88FCF575225E2F21CA50A951784FDC67
                                                                                          SHA1:288EC4F3D0AD7EACEDE7820FABD8642672C876A7
                                                                                          SHA-256:0E1EB6FE9FE24AC8F1D12BD1959C8B799A5815D5323903BD89725C3947560A10
                                                                                          SHA-512:552DC8294BA2DFE9CA2ABB52D8C726AB7E410681B84BDC5A834DFAB4636C7CC7037E001EEF9FF90A9671FAA5CC8BBB69790A7936272C8F4441D869C66997A6C3
                                                                                          Malicious:false
                                                                                          Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369079522134286","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                                                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2278
                                                                                          Entropy (8bit):3.84685952582527
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:uiTrlKxrgxxxl9Il8uA8XK0EHkqlcDGKX4J+rz1old1rc:m0Y28X/EHplcqKNJ
                                                                                          MD5:5950B3162F560698D715528E2DFC64BF
                                                                                          SHA1:F95ABE598C240801B41EDBA0811374AB4AE8F224
                                                                                          SHA-256:2AD8BA2AD6E7118152EF3495C22B535C7A080534E23262F7E3EA6E03B2C2D4C5
                                                                                          SHA-512:F6BF98A7A094D56A6156DCEB20D7004CF5807AD00159EEF46B435F1E3F79C2FD827BED91627DC4A832C5AD56C8372E6B3A7EA23D840142CAD23A5ADA5A2031E1
                                                                                          Malicious:false
                                                                                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.h.i.S.h.r.3.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A./.R.l.P.O.k.

                                                                                          C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4622
                                                                                          Entropy (8bit):3.9949951247875033
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:uiTrlKxExP7xD9Il8uJ5ssaXybvfH8XC2pfUmjZ2QgTC+4nX6mGS2fMPZXXTm1gl:TJYYXGHOC2OmMC+Fy2ajmuOTVBv8
                                                                                          MD5:D187EC0250DAF0B6F9EC3E14DD37AEAC
                                                                                          SHA1:3D72B60FBDAD4F9185E56EEA3C506A9C01847002
                                                                                          SHA-256:19BA4B58F085B674E173CFA343E5FF2116DF4A776FDE4DCF487FC335209DB661
                                                                                          SHA-512:79499D66208870F4F3FD986C5506E3C8EC12D19D9FF7517BC874C2D9A273F2C98FAFDEBB288558D12AC7C93ED39E976D03B519287899AF7AB82F3403F48B3871
                                                                                          Malicious:false
                                                                                          Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".U.6.0.D.M.B.L.3.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A./.R.l.P.O.k.

                                                                                          C:\Users\user\AppData\Local\Temp\0b404f17-5073-4dc9-bc5e-e91f2c2253e2.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                          Category:dropped
                                                                                          Size (bytes):206855
                                                                                          Entropy (8bit):7.983996634657522
                                                                                          Encrypted:false
                                                                                          SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                                                          MD5:788DF0376CE061534448AA17288FEA95
                                                                                          SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                                                          SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                                                          SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                                                          Malicious:false
                                                                                          Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                                                          C:\Users\user\AppData\Local\Temp\10649819-db94-4ba7-bad7-2326d4d403bb.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Google Chrome extension, version 3
                                                                                          Category:dropped
                                                                                          Size (bytes):11185
                                                                                          Entropy (8bit):7.951995436832936
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                          MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                          SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                          SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                          SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                          Malicious:false
                                                                                          Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                          C:\Users\user\AppData\Local\Temp\23144748-e9d9-41c3-98d5-fb249a370604.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
                                                                                          Category:dropped
                                                                                          Size (bytes):76319
                                                                                          Entropy (8bit):7.996132588300074
                                                                                          Encrypted:true
                                                                                          SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
                                                                                          MD5:24439F0E82F6A60E541FB2697F02043F
                                                                                          SHA1:E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
                                                                                          SHA-256:B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
                                                                                          SHA-512:8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
                                                                                          Malicious:false
                                                                                          Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                                                          C:\Users\user\AppData\Local\Temp\7299dab2-2eb7-42e6-8101-2d3da317aa7a.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:very short file (no magic)
                                                                                          Category:dropped
                                                                                          Size (bytes):1
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:L:L
                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                          Malicious:false
                                                                                          Preview:.

                                                                                          C:\Users\user\AppData\Local\Temp\7457d559-5029-4c0e-9b8d-e7904de0a48f.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Google Chrome extension, version 3
                                                                                          Category:dropped
                                                                                          Size (bytes):135751
                                                                                          Entropy (8bit):7.804610863392373
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                                                          MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                                                          SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                                                          SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                                                          SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                                                          Malicious:false
                                                                                          Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                                                          C:\Users\user\AppData\Local\Temp\9b610a21-0083-422e-a26d-960ed361ac3a.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 910697
                                                                                          Category:dropped
                                                                                          Size (bytes):482563
                                                                                          Entropy (8bit):7.9981863670404225
                                                                                          Encrypted:true
                                                                                          SSDEEP:12288:CqNwbrUfUQqWdCi/S9HBz2PKgtvuAUQedwN:CVrgUQqWdCiKr3gfpN
                                                                                          MD5:42390EAC11419827C45BC7564CC93BD0
                                                                                          SHA1:0C398E744161CB370BE6F25CA0B60C296832FDF7
                                                                                          SHA-256:8300DC963B2CE672CB067DA67B3CFF42274E8C56EF712D7EB25E386C93D7E35C
                                                                                          SHA-512:42DC8A4FC0F3D17B25A3D84603BB33323EE1E5DE237AFD54884033095E84EB907DDB436F7AAE6A1803753528C5791BA99DB5AED970F8E66E04A1E46F2090295A
                                                                                          Malicious:false
                                                                                          Preview:............o.6.........I....d[.z.6l.=...dIV...q..0...Iyk.C..8.R...v\7.....u..'..r...=.w..W.}..V_....W7......~..........<..f.-.O...l....a.../....l.m.e..kv.Y.n...~......}...ww..uSt.U..o.O...G..4w..|...........]]..y../..W.n...........".y..WB.2*C.7..W.4.....M...I..\&.($...."'....Y.e..o.7y.K.......oZ2.?..qW.O.$.............<.kV`2)G..%,...2.."Q..M.....}g.M`qa.x.Z_....N"......~.~.....;..4.....XEX...B0.Q=.'...z.,.|.>.5..W.6..$\RaT.&.m.%.b.2.....5#[..\...z.j.j|......~RN....@p.C.1.j.}..}..Z..Co'.i.%.TZ...O=%.`.J+............Y|.....mp.6...;v...l?...!..?"Q....a....'.8...)..)7..N...B.8...Yj.?..........V../...g....C..i.....IN...P..P.@.....N..u/...FJ.A<N<..gD. #..6....N.F.....C......4..........?R@.K../-%..P...|.././.o..?#K......%..=.8;........J..............6"..2.........jI....A..W.3......[.....$...>.%iJ..g..A...._....B.>.r...G.5.....$.P[.....J..r.y.4.KE.Lj/)i".w..Ig./.k?.....l../Z.f......"|%.-..T.....).l."Q..j*>%..E.J6...l...^.f.=`%./.l......7$D

                                                                                          C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):353
                                                                                          Entropy (8bit):5.407732923280226
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YEB5xc2q5OgC56s/uBJMCPRjTOppLQJjDrwv/uBJMIDAXEUYTL56s/C:YiHKOgC56s/hsgzL0Dkv/hkAQL56s/C
                                                                                          MD5:8AA1A971CF518427208FBAB240782DCF
                                                                                          SHA1:29E1432E5380B21B207689578749D2CBBBCCBB49
                                                                                          SHA-256:43895FA82EA43F1D64052E63199DCBE8B79C71AB354F682077FF4078041ED790
                                                                                          SHA-512:8AAECD4FF17A76F5BB3A561E8CCF004A3BEB397EE0715518283F052A68D3010C38914EFB2730E9C6500ADFB65E05C1032F547D699ABADFFC57D6A072AF78E8B8
                                                                                          Malicious:false
                                                                                          Preview:{"logTime": "0825/171207", "correlationVector":"zqockSFsWpKkbWMw++0GA5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0825/171208", "correlationVector":"3AB4680AE95048F6B0440122986AAC2D","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0825/171208", "correlationVector":"Ck6usvdY9iORV35Ia1offt","action":"EXTENSION_UPDATER", "result":""}.

                                                                                          C:\Users\user\AppData\Local\Temp\fc3b61de-3762-4235-ab27-357ebd2e29e3.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:very short file (no magic)
                                                                                          Category:dropped
                                                                                          Size (bytes):1
                                                                                          Entropy (8bit):0.0
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:L:L
                                                                                          MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                          SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                          SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                          SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                          Malicious:false
                                                                                          Preview:.

                                                                                          C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                          Category:dropped
                                                                                          Size (bytes):32768
                                                                                          Entropy (8bit):0.4593089050301797
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                          MD5:D910AD167F0217587501FDCDB33CC544
                                                                                          SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                          SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                          SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                          Malicious:false
                                                                                          Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\7457d559-5029-4c0e-9b8d-e7904de0a48f.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Google Chrome extension, version 3
                                                                                          Category:dropped
                                                                                          Size (bytes):135751
                                                                                          Entropy (8bit):7.804610863392373
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                                                          MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                                                          SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                                                          SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                                                          SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                                                          Malicious:false
                                                                                          Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\128.png

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                          Category:dropped
                                                                                          Size (bytes):4982
                                                                                          Entropy (8bit):7.929761711048726
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                          MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                          SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                          SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                          SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                          Malicious:false
                                                                                          Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\af\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):908
                                                                                          Entropy (8bit):4.512512697156616
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                          MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                          SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                          SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                          SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\am\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1285
                                                                                          Entropy (8bit):4.702209356847184
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                          MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                          SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                          SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                          SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ar\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1244
                                                                                          Entropy (8bit):4.5533961615623735
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                          MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                          SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                          SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                          SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\az\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):977
                                                                                          Entropy (8bit):4.867640976960053
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                          MD5:9A798FD298008074E59ECC253E2F2933
                                                                                          SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                          SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                          SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\be\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3107
                                                                                          Entropy (8bit):3.535189746470889
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                          MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                          SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                          SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                          SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\bg\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1389
                                                                                          Entropy (8bit):4.561317517930672
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                          MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                          SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                          SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                          SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\bn\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1763
                                                                                          Entropy (8bit):4.25392954144533
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                          MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                          SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                          SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                          SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ca\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):930
                                                                                          Entropy (8bit):4.569672473374877
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                          MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                          SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                          SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                          SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\cs\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):913
                                                                                          Entropy (8bit):4.947221919047
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                          MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                          SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                          SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                          SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\cy\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):806
                                                                                          Entropy (8bit):4.815663786215102
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                          MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                          SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                          SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                          SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\da\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):883
                                                                                          Entropy (8bit):4.5096240460083905
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                          MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                          SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                          SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                          SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\de\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1031
                                                                                          Entropy (8bit):4.621865814402898
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                          MD5:D116453277CC860D196887CEC6432FFE
                                                                                          SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                          SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                          SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\el\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1613
                                                                                          Entropy (8bit):4.618182455684241
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                          MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                          SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                          SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                          SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\en\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):851
                                                                                          Entropy (8bit):4.4858053753176526
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                          MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                          SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                          SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                          SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):851
                                                                                          Entropy (8bit):4.4858053753176526
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                          MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                          SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                          SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                          SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\en_GB\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):848
                                                                                          Entropy (8bit):4.494568170878587
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                          MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                          SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                          SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                          SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\en_US\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1425
                                                                                          Entropy (8bit):4.461560329690825
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                          MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                          SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                          SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                          SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                          Malicious:false
                                                                                          Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\es\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):961
                                                                                          Entropy (8bit):4.537633413451255
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                          MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                          SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                          SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                          SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\es_419\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):959
                                                                                          Entropy (8bit):4.570019855018913
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                          MD5:535331F8FB98894877811B14994FEA9D
                                                                                          SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                          SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                          SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\et\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):968
                                                                                          Entropy (8bit):4.633956349931516
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                          MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                          SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                          SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                          SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\eu\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):838
                                                                                          Entropy (8bit):4.4975520913636595
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                          MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                          SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                          SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                          SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\fa\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1305
                                                                                          Entropy (8bit):4.673517697192589
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                          MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                          SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                          SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                          SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\fi\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):911
                                                                                          Entropy (8bit):4.6294343834070935
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                          MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                          SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                          SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                          SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\fil\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):939
                                                                                          Entropy (8bit):4.451724169062555
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                          MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                          SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                          SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                          SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\fr\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):977
                                                                                          Entropy (8bit):4.622066056638277
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                          MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                          SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                          SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                          SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\fr_CA\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):972
                                                                                          Entropy (8bit):4.621319511196614
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                          MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                          SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                          SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                          SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\gl\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):990
                                                                                          Entropy (8bit):4.497202347098541
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                          MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                          SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                          SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                          SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\gu\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1658
                                                                                          Entropy (8bit):4.294833932445159
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                          MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                          SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                          SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                          SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\hi\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1672
                                                                                          Entropy (8bit):4.314484457325167
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                          MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                          SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                          SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                          SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\hr\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):935
                                                                                          Entropy (8bit):4.6369398601609735
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                          MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                          SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                          SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                          SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\hu\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1065
                                                                                          Entropy (8bit):4.816501737523951
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                          MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                          SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                          SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                          SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\hy\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2771
                                                                                          Entropy (8bit):3.7629875118570055
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                          MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                          SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                          SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                          SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\id\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):858
                                                                                          Entropy (8bit):4.474411340525479
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                          MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                          SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                          SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                          SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\is\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):954
                                                                                          Entropy (8bit):4.631887382471946
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                                                          MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                                                          SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                                                          SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                                                          SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\it\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):899
                                                                                          Entropy (8bit):4.474743599345443
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                          MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                          SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                          SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                          SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\iw\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2230
                                                                                          Entropy (8bit):3.8239097369647634
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                          MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                          SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                          SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                          SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ja\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1160
                                                                                          Entropy (8bit):5.292894989863142
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                          MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                          SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                          SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                          SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ka\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3264
                                                                                          Entropy (8bit):3.586016059431306
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                          MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                          SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                          SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                          SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\kk\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3235
                                                                                          Entropy (8bit):3.6081439490236464
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                          MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                          SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                          SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                          SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\km\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3122
                                                                                          Entropy (8bit):3.891443295908904
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                          MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                          SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                          SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                          SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\kn\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1880
                                                                                          Entropy (8bit):4.295185867329351
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                                                          MD5:8E16966E815C3C274EEB8492B1EA6648
                                                                                          SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                                                          SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                                                          SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ko\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1042
                                                                                          Entropy (8bit):5.3945675025513955
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                          MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                          SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                          SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                          SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\lo\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2535
                                                                                          Entropy (8bit):3.8479764584971368
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                          MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                          SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                          SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                          SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\lt\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1028
                                                                                          Entropy (8bit):4.797571191712988
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                          MD5:970544AB4622701FFDF66DC556847652
                                                                                          SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                          SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                          SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\lv\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):994
                                                                                          Entropy (8bit):4.700308832360794
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                          MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                          SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                          SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                          SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ml\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2091
                                                                                          Entropy (8bit):4.358252286391144
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                          MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                          SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                          SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                          SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\mn\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2778
                                                                                          Entropy (8bit):3.595196082412897
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                          MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                          SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                          SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                          SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\mr\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1719
                                                                                          Entropy (8bit):4.287702203591075
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                          MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                          SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                          SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                          SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ms\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):936
                                                                                          Entropy (8bit):4.457879437756106
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                          MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                          SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                          SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                          SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\my\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):3830
                                                                                          Entropy (8bit):3.5483353063347587
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                          MD5:342335A22F1886B8BC92008597326B24
                                                                                          SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                          SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                          SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ne\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1898
                                                                                          Entropy (8bit):4.187050294267571
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                          MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                          SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                          SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                          SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\nl\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):914
                                                                                          Entropy (8bit):4.513485418448461
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                          MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                          SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                          SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                          SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\no\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):878
                                                                                          Entropy (8bit):4.4541485835627475
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                          MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                          SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                          SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                          SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\pa\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2766
                                                                                          Entropy (8bit):3.839730779948262
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                          MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                          SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                          SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                          SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\pl\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):978
                                                                                          Entropy (8bit):4.879137540019932
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                          MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                          SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                          SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                          SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\pt_BR\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):907
                                                                                          Entropy (8bit):4.599411354657937
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                          MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                          SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                          SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                          SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\pt_PT\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):914
                                                                                          Entropy (8bit):4.604761241355716
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                          MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                          SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                          SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                          SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ro\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):937
                                                                                          Entropy (8bit):4.686555713975264
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                          MD5:BED8332AB788098D276B448EC2B33351
                                                                                          SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                          SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                          SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ru\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1337
                                                                                          Entropy (8bit):4.69531415794894
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                          MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                          SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                          SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                          SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\si\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2846
                                                                                          Entropy (8bit):3.7416822879702547
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                          MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                          SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                          SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                          SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\sk\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):934
                                                                                          Entropy (8bit):4.882122893545996
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                          MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                          SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                          SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                          SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\sl\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):963
                                                                                          Entropy (8bit):4.6041913416245
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                          MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                          SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                          SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                          SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\sr\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1320
                                                                                          Entropy (8bit):4.569671329405572
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                          MD5:7F5F8933D2D078618496C67526A2B066
                                                                                          SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                          SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                          SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\sv\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):884
                                                                                          Entropy (8bit):4.627108704340797
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                          MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                          SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                          SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                          SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\sw\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):980
                                                                                          Entropy (8bit):4.50673686618174
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                          MD5:D0579209686889E079D87C23817EDDD5
                                                                                          SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                          SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                          SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ta\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1941
                                                                                          Entropy (8bit):4.132139619026436
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                          MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                          SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                          SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                          SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\te\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1969
                                                                                          Entropy (8bit):4.327258153043599
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                          MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                          SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                          SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                          SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\th\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1674
                                                                                          Entropy (8bit):4.343724179386811
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                          MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                          SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                          SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                          SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\tr\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1063
                                                                                          Entropy (8bit):4.853399816115876
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                          MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                          SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                          SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                          SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\uk\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1333
                                                                                          Entropy (8bit):4.686760246306605
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                          MD5:970963C25C2CEF16BB6F60952E103105
                                                                                          SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                          SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                          SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\ur\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1263
                                                                                          Entropy (8bit):4.861856182762435
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                          MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                          SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                          SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                          SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\vi\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1074
                                                                                          Entropy (8bit):5.062722522759407
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                          MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                          SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                          SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                          SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\zh_CN\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):879
                                                                                          Entropy (8bit):5.7905809868505544
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                          MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                          SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                          SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                          SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\zh_HK\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1205
                                                                                          Entropy (8bit):4.50367724745418
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                          MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                          SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                          SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                          SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\zh_TW\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):843
                                                                                          Entropy (8bit):5.76581227215314
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                          MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                          SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                          SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                          SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                          Malicious:false
                                                                                          Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_locales\zu\messages.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):912
                                                                                          Entropy (8bit):4.65963951143349
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                          MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                          SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                          SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                          SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                          Malicious:false
                                                                                          Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\_metadata\verified_contents.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):11280
                                                                                          Entropy (8bit):5.754230909218899
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
                                                                                          MD5:BE5DB35513DDEF454CE3502B6418B9B4
                                                                                          SHA1:C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
                                                                                          SHA-256:C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
                                                                                          SHA-512:38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
                                                                                          Malicious:false
                                                                                          Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\dasherSettingSchema.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):854
                                                                                          Entropy (8bit):4.284628987131403
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                          MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                          SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                          SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                          SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                          Malicious:false
                                                                                          Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\manifest.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):2525
                                                                                          Entropy (8bit):5.417689528134667
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
                                                                                          MD5:10FF8E5B674311683D27CE1879384954
                                                                                          SHA1:9C269C14E067BB86642EB9F4816D75CF1B9B9158
                                                                                          SHA-256:17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
                                                                                          SHA-512:4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
                                                                                          Malicious:false
                                                                                          Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\offscreendocument.html

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:HTML document, ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):97
                                                                                          Entropy (8bit):4.862433271815736
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                                                          MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                                                          SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                                                          SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                                                          SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                                                          Malicious:false
                                                                                          Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\offscreendocument_main.js

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with very long lines (4369)
                                                                                          Category:dropped
                                                                                          Size (bytes):95567
                                                                                          Entropy (8bit):5.4016395763198135
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
                                                                                          MD5:09AF2D8CFA8BF1078101DA78D09C4174
                                                                                          SHA1:F2369551E2CDD86258062BEB0729EE4D93FCA050
                                                                                          SHA-256:39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
                                                                                          SHA-512:F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
                                                                                          Malicious:false
                                                                                          Preview:'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\page_embed_script.js

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):291
                                                                                          Entropy (8bit):4.65176400421739
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                                                          MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                                                          SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                                                          SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                                                          SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                                                          Malicious:false
                                                                                          Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1644706887\CRX_INSTALL\service_worker_bin_prod.js

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:ASCII text, with very long lines (4369)
                                                                                          Category:dropped
                                                                                          Size (bytes):103988
                                                                                          Entropy (8bit):5.389407461078688
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
                                                                                          MD5:EA946F110850F17E637B15CF22B82837
                                                                                          SHA1:8D27C963E76E3D2F5B8634EE66706F95F000FCAF
                                                                                          SHA-256:029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
                                                                                          SHA-512:5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
                                                                                          Malicious:false
                                                                                          Preview:'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1903409831\10649819-db94-4ba7-bad7-2326d4d403bb.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Google Chrome extension, version 3
                                                                                          Category:dropped
                                                                                          Size (bytes):11185
                                                                                          Entropy (8bit):7.951995436832936
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                          MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                          SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                          SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                          SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                          Malicious:false
                                                                                          Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1903409831\CRX_INSTALL\_metadata\verified_contents.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):1753
                                                                                          Entropy (8bit):5.8889033066924155
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                          MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                          SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                          SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                          SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                          Malicious:false
                                                                                          Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1903409831\CRX_INSTALL\content.js

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):9815
                                                                                          Entropy (8bit):6.1716321262973315
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                          MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                          SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                          SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                          SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                          Malicious:false
                                                                                          Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1903409831\CRX_INSTALL\content_new.js

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):10388
                                                                                          Entropy (8bit):6.174387413738973
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                          MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                          SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                          SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                          SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                          Malicious:false
                                                                                          Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                          C:\Users\user\AppData\Local\Temp\scoped_dir7188_1903409831\CRX_INSTALL\manifest.json

                                                                                          Download File
                                                                                          Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):962
                                                                                          Entropy (8bit):5.698567446030411
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                          MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                          SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                          SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                          SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                          Malicious:false
                                                                                          Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                                                          C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                          Category:dropped
                                                                                          Size (bytes):453023
                                                                                          Entropy (8bit):7.997718157581587
                                                                                          Encrypted:true
                                                                                          SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                          MD5:85430BAED3398695717B0263807CF97C
                                                                                          SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                          SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                          SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                          Malicious:false
                                                                                          Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24
                                                                                          Entropy (8bit):3.91829583405449
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                          MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                          SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                          SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                          SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                          Malicious:false
                                                                                          Preview:{"schema":6,"addons":[]}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):24
                                                                                          Entropy (8bit):3.91829583405449
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                          MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                          SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                          SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                          SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                          Malicious:false
                                                                                          Preview:{"schema":6,"addons":[]}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                          Category:dropped
                                                                                          Size (bytes):66
                                                                                          Entropy (8bit):4.837595020998689
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                          MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                          SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                          SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                          SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                          Malicious:false
                                                                                          Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                          Category:dropped
                                                                                          Size (bytes):66
                                                                                          Entropy (8bit):4.837595020998689
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                          MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                          SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                          SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                          SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                          Malicious:false
                                                                                          Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):36830
                                                                                          Entropy (8bit):5.185924656884556
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                                                          MD5:5656BA69BD2966108A461AAE35F60226
                                                                                          SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                                                          SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                                                          SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                                                          Malicious:false
                                                                                          Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):36830
                                                                                          Entropy (8bit):5.185924656884556
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                                                          MD5:5656BA69BD2966108A461AAE35F60226
                                                                                          SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                                                          SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                                                          SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                                                          Malicious:false
                                                                                          Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):1021904
                                                                                          Entropy (8bit):6.648417932394748
                                                                                          Encrypted:false
                                                                                          SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                          MD5:FE3355639648C417E8307C6D051E3E37
                                                                                          SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                          SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                          SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                          Malicious:false
                                                                                          Antivirus:
                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                          Joe Sandbox View:
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):1021904
                                                                                          Entropy (8bit):6.648417932394748
                                                                                          Encrypted:false
                                                                                          SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                          MD5:FE3355639648C417E8307C6D051E3E37
                                                                                          SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                          SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                          SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                          Malicious:false
                                                                                          Antivirus:
                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                          Joe Sandbox View:
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          • Filename: file.exe, Detection: malicious, Browse
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):116
                                                                                          Entropy (8bit):4.968220104601006
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                          MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                          SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                          SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                          SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                          Malicious:false
                                                                                          Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:ASCII text
                                                                                          Category:dropped
                                                                                          Size (bytes):116
                                                                                          Entropy (8bit):4.968220104601006
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                          MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                          SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                          SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                          SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                          Malicious:false
                                                                                          Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                          Category:modified
                                                                                          Size (bytes):11292
                                                                                          Entropy (8bit):5.5294908046784474
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:inaRtZYbBp6ihj4qyaaXq6KoikfGNBw8rYSl:legquPHcwp0
                                                                                          MD5:A332AC1EFCCE36979D99B99FAE76E9E7
                                                                                          SHA1:B12098628C915EED3B4F299EF739474B2863D140
                                                                                          SHA-256:10F7A7839A959E4E7F8C6F878A5AEFBB5F6BD7441FB557E50EFA72FEACE84B41
                                                                                          SHA-512:81DA2CCB2A3FD35092CB85A46BB5278D932259A2AE8AA4709AEA74E4EE29E7A9CA07CCE6E0B5AE6545F5B9F9BEB0D722598E35822DAF9359984D2717F5C8AB57
                                                                                          Malicious:false
                                                                                          Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1724612075);..user_pref("app.update.lastUpdateTime.background-update-timer", 1724612075);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):11292
                                                                                          Entropy (8bit):5.5294908046784474
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:inaRtZYbBp6ihj4qyaaXq6KoikfGNBw8rYSl:legquPHcwp0
                                                                                          MD5:A332AC1EFCCE36979D99B99FAE76E9E7
                                                                                          SHA1:B12098628C915EED3B4F299EF739474B2863D140
                                                                                          SHA-256:10F7A7839A959E4E7F8C6F878A5AEFBB5F6BD7441FB557E50EFA72FEACE84B41
                                                                                          SHA-512:81DA2CCB2A3FD35092CB85A46BB5278D932259A2AE8AA4709AEA74E4EE29E7A9CA07CCE6E0B5AE6545F5B9F9BEB0D722598E35822DAF9359984D2717F5C8AB57
                                                                                          Malicious:false
                                                                                          Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1724612075);..user_pref("app.update.lastUpdateTime.background-update-timer", 1724612075);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):53
                                                                                          Entropy (8bit):4.136624295551173
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                                                          MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                                                          SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                                                          SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                                                          SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                                                          Malicious:false
                                                                                          Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:JSON data
                                                                                          Category:dropped
                                                                                          Size (bytes):53
                                                                                          Entropy (8bit):4.136624295551173
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                                                          MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                                                          SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                                                          SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                                                          SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                                                          Malicious:false
                                                                                          Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                                                          Category:dropped
                                                                                          Size (bytes):271
                                                                                          Entropy (8bit):5.492962968914577
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCIR7tV1JNzdDdCQ:vLz2S+EWDDoWqC+bfPK34FJvd9
                                                                                          MD5:D8896DC30FFBBA78CCF908AD97BEC96B
                                                                                          SHA1:0E031C8442CA9EA39335A2BE3EA1BD97FDA12CC1
                                                                                          SHA-256:D4ED60FBE5EF6E8A90D7E97FC5DBD13BCA39791CC34ADA559999004631DE55F6
                                                                                          SHA-512:CE3D76B60F8E2F325F08E06B21041C3308C247DE766852A963EB91D830B1D2C6A2817C9699DCC8DAEA31F6498CB70C83A80299D5506D998319AD783A7B2CA870
                                                                                          Malicious:false
                                                                                          Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1724612066876,"startTim...#45392,"recentCrashes":0},"global":{},"cookies":[]}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                          Download File
                                                                                          Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                                                          Category:dropped
                                                                                          Size (bytes):271
                                                                                          Entropy (8bit):5.492962968914577
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCIR7tV1JNzdDdCQ:vLz2S+EWDDoWqC+bfPK34FJvd9
                                                                                          MD5:D8896DC30FFBBA78CCF908AD97BEC96B
                                                                                          SHA1:0E031C8442CA9EA39335A2BE3EA1BD97FDA12CC1
                                                                                          SHA-256:D4ED60FBE5EF6E8A90D7E97FC5DBD13BCA39791CC34ADA559999004631DE55F6
                                                                                          SHA-512:CE3D76B60F8E2F325F08E06B21041C3308C247DE766852A963EB91D830B1D2C6A2817C9699DCC8DAEA31F6498CB70C83A80299D5506D998319AD783A7B2CA870
                                                                                          Malicious:false
                                                                                          Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1724612066876,"startTim...#45392,"recentCrashes":0},"global":{},"cookies":[]}

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                          Entropy (8bit):6.579636633756498
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                          File name:file.exe
                                                                                          File size:917'504 bytes
                                                                                          MD5:26e9a7949cc17782f6595ea8cc61cc51
                                                                                          SHA1:4af94b27f3644e20deb5e439346d72ef1c634ddf
                                                                                          SHA256:c3e67343b828fb0867a816f099b4363539fe3d350857d015613549533d5a26fd
                                                                                          SHA512:6b6f87c6d0545bccd45a23eefee6e46c281967072d6787d6074892e561d141e4a53411ceecd7011e4d691b5214bffaaca1e3a0063440960ad3e8ab7e9fc13fcd
                                                                                          SSDEEP:12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTT:uqDEvCTbMWu7rQYlBQcBiT6rprG8avT
                                                                                          TLSH:40159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                                                          File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                                                          File Icon

                                                                                          Icon Hash:aaf3e3e3938382a0

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x420577
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                          DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0x66CB6568 [Sun Aug 25 17:10:00 2024 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:5
                                                                                          OS Version Minor:1
                                                                                          File Version Major:5
                                                                                          File Version Minor:1
                                                                                          Subsystem Version Major:5
                                                                                          Subsystem Version Minor:1
                                                                                          Import Hash:948cc502fe9226992dce9417f952fce3

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          call 00007FDDA47FE5B3h
                                                                                          jmp 00007FDDA47FDEBFh
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          push esi
                                                                                          push dword ptr [ebp+08h]
                                                                                          mov esi, ecx
                                                                                          call 00007FDDA47FE09Dh
                                                                                          mov dword ptr [esi], 0049FDF0h
                                                                                          mov eax, esi
                                                                                          pop esi
                                                                                          pop ebp
                                                                                          retn 0004h
                                                                                          and dword ptr [ecx+04h], 00000000h
                                                                                          mov eax, ecx
                                                                                          and dword ptr [ecx+08h], 00000000h
                                                                                          mov dword ptr [ecx+04h], 0049FDF8h
                                                                                          mov dword ptr [ecx], 0049FDF0h
                                                                                          ret
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          push esi
                                                                                          push dword ptr [ebp+08h]
                                                                                          mov esi, ecx
                                                                                          call 00007FDDA47FE06Ah
                                                                                          mov dword ptr [esi], 0049FE0Ch
                                                                                          mov eax, esi
                                                                                          pop esi
                                                                                          pop ebp
                                                                                          retn 0004h
                                                                                          and dword ptr [ecx+04h], 00000000h
                                                                                          mov eax, ecx
                                                                                          and dword ptr [ecx+08h], 00000000h
                                                                                          mov dword ptr [ecx+04h], 0049FE14h
                                                                                          mov dword ptr [ecx], 0049FE0Ch
                                                                                          ret
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          push esi
                                                                                          mov esi, ecx
                                                                                          lea eax, dword ptr [esi+04h]
                                                                                          mov dword ptr [esi], 0049FDD0h
                                                                                          and dword ptr [eax], 00000000h
                                                                                          and dword ptr [eax+04h], 00000000h
                                                                                          push eax
                                                                                          mov eax, dword ptr [ebp+08h]
                                                                                          add eax, 04h
                                                                                          push eax
                                                                                          call 00007FDDA4800C5Dh
                                                                                          pop ecx
                                                                                          pop ecx
                                                                                          mov eax, esi
                                                                                          pop esi
                                                                                          pop ebp
                                                                                          retn 0004h
                                                                                          lea eax, dword ptr [ecx+04h]
                                                                                          mov dword ptr [ecx], 0049FDD0h
                                                                                          push eax
                                                                                          call 00007FDDA4800CA8h
                                                                                          pop ecx
                                                                                          ret
                                                                                          push ebp
                                                                                          mov ebp, esp
                                                                                          push esi
                                                                                          mov esi, ecx
                                                                                          lea eax, dword ptr [esi+04h]
                                                                                          mov dword ptr [esi], 0049FDD0h
                                                                                          push eax
                                                                                          call 00007FDDA4800C91h
                                                                                          test byte ptr [ebp+08h], 00000001h
                                                                                          pop ecx

                                                                                          Rich Headers

                                                                                          Programming Language:
                                                                                          • [ C ] VS2008 SP1 build 30729
                                                                                          • [IMP] VS2008 SP1 build 30729

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9500.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                          .rsrc0xd40000x95000x9600b69a4c193a37743ca9792803e915cbc9False0.28122395833333336data5.161883498798214IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                          RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                          RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                          RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                          RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                          RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                          RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                          RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                          RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                          RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                          RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                          RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                                                          RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                          RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                                                          RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                          RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                          RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                          RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                          RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                          RT_RCDATA0xdc7b80x7c6data1.0055276381909548
                                                                                          RT_GROUP_ICON0xdcf800x76dataEnglishGreat Britain0.6610169491525424
                                                                                          RT_GROUP_ICON0xdcff80x14dataEnglishGreat Britain1.25
                                                                                          RT_GROUP_ICON0xdd00c0x14dataEnglishGreat Britain1.15
                                                                                          RT_GROUP_ICON0xdd0200x14dataEnglishGreat Britain1.25
                                                                                          RT_VERSION0xdd0340xdcdataEnglishGreat Britain0.6181818181818182
                                                                                          RT_MANIFEST0xdd1100x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                                                          Imports

                                                                                          DLLImport
                                                                                          WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                                                          VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                          WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                          COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                                                          MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                                                          WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                                                          PSAPI.DLLGetProcessMemoryInfo
                                                                                          IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                                                          USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                                                          UxTheme.dllIsThemeActive
                                                                                          KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                                                          USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                                                          GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                                                          COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                          ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                                                          SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                                                          ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                          OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                                                          Possible Origin

                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                          EnglishGreat Britain

                                                                                          Network Behavior

                                                                                          Network Port Distribution

                                                                                          TCP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Aug 25, 2024 19:11:53.718631983 CEST49675443192.168.2.4173.222.162.32
                                                                                          Aug 25, 2024 19:12:03.381741047 CEST49675443192.168.2.4173.222.162.32
                                                                                          Aug 25, 2024 19:12:07.364425898 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.369282961 CEST53497511.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.369379044 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.369503975 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.369514942 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.374285936 CEST53497511.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.374309063 CEST53497511.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.833517075 CEST53497511.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.835855961 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.840970993 CEST53497511.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.841038942 CEST4975153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.997088909 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:07.997101068 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.997163057 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:07.997354984 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:07.997369051 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.997427940 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:07.997546911 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:07.997558117 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.997649908 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:07.997663975 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.147321939 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.147330999 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.151289940 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.152029991 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.152046919 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.167835951 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.167860031 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.167988062 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.168015957 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.173759937 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.173820019 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.174099922 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.174110889 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.174205065 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.174222946 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.223181009 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.223208904 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.223273039 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.223402023 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.223416090 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.457102060 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.462038040 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.462050915 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.463078976 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.465007067 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.465879917 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.466064930 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.466131926 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.466231108 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.466238022 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.466329098 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.466335058 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.467252016 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.467801094 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.469794989 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.469866037 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.469934940 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.512516975 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.558403969 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.558406115 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.558425903 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.572262049 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.572345018 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.573688984 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.573957920 CEST49761443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:08.573964119 CEST44349761162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.605317116 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.605736017 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.606153965 CEST49762443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.606161118 CEST44349762172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.624917984 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.625741005 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.625747919 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.626738071 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.627960920 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.629015923 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.629077911 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.629226923 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.675093889 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.675101995 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.748084068 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.748267889 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.748459101 CEST49763443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:08.748462915 CEST44349763172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.818175077 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.819684982 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.820327044 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.820339918 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.820415020 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.820439100 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.821578979 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.821671009 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.821854115 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.822088003 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.822710037 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.822772026 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.822803974 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.822885036 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.822977066 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.823030949 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.861612082 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.864319086 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.864335060 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.864496946 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.864500046 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.865813971 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.870987892 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.871316910 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.871402025 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.871587992 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.916497946 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.921799898 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.921844006 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.921863079 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.922005892 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.923795938 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.929809093 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.929848909 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.929862022 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.935400009 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.935404062 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.935426950 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.935457945 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.936527967 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.956598997 CEST49764443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.956620932 CEST4434976413.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.978838921 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.978859901 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.983730078 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:08.983747005 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.983756065 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.998763084 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.010482073 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.010490894 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.010531902 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.010541916 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.010560036 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.010565996 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.011576891 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.012834072 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.012845993 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.012852907 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.012882948 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.012902975 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.012913942 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.012934923 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.013849020 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.013860941 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.016839981 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.058015108 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.058027029 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.058052063 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.058072090 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.058082104 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.058113098 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.059197903 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.059211016 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.059299946 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.060372114 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.060379982 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.060403109 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.060430050 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.061207056 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.061222076 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.061781883 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.097656012 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097664118 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097690105 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097701073 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097749949 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097774982 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.097826004 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.100668907 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.100856066 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.101849079 CEST49765443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.101869106 CEST4434976513.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.143150091 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.143162012 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.143193007 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.144608021 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.144619942 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.144644022 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.146367073 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.146377087 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.151073933 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.151087046 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.151128054 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.153393030 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.153405905 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.153430939 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.153516054 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.153516054 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.153522968 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.230691910 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.230741024 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.231194019 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.231209993 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.231340885 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.231544018 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.231564045 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.231616974 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.231623888 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.231648922 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.232809067 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.232867956 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.232873917 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.232886076 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.232973099 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.232978106 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.233685017 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.233710051 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.233980894 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.233987093 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.234199047 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.234486103 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.234504938 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.235069990 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.235075951 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.235202074 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.235460997 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.235480070 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.235855103 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.235865116 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.236144066 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.236670971 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.236690044 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.237648964 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.237654924 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.237821102 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.316838026 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.316865921 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317137003 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317173004 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317428112 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317456007 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317712069 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317734957 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.317878962 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.323534012 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.323822975 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.323895931 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.324146032 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.324193001 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.330354929 CEST49766443192.168.2.413.107.246.67
                                                                                          Aug 25, 2024 19:12:09.330374002 CEST4434976613.107.246.67192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.345340967 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:09.345379114 CEST4434976735.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.346088886 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:09.351433992 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:09.351447105 CEST4434976735.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.603452921 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.603477001 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.603625059 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.603636980 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.609260082 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.609308004 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.609985113 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.609997988 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.610094070 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.610107899 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.823971987 CEST4434976735.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.828319073 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:10.006140947 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.006151915 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.006278992 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.006294012 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.019767046 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.019905090 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.020581007 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.020593882 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.020697117 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.020709038 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.041116953 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.041150093 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.041294098 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.042819023 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.042829990 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.070030928 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.070861101 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.070868969 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.071213007 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.071685076 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.071749926 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.075687885 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.075922966 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.075931072 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.076365948 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.077220917 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.077296972 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.155459881 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.279401064 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.347054005 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:10.347098112 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.347266912 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:10.347495079 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:10.347507954 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.372184992 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:10.372201920 CEST4434976735.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.372350931 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:10.372446060 CEST4434976735.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.372512102 CEST49767443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:10.392410994 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:10.397274017 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.397353888 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:10.397538900 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:10.403624058 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.478671074 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.504928112 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.504945993 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.505449057 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.505460978 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.505875111 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.506222010 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.507168055 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.508562088 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.508632898 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.508982897 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.523694038 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.527632952 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.527693033 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.528037071 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.528045893 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.528240919 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.528650045 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.529858112 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.530272961 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.530330896 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.530410051 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.530419111 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.556512117 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.584949970 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.584969997 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.615669966 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.620047092 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.621083021 CEST49770443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.621093035 CEST44349770142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.643702984 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.655000925 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.658230066 CEST49771443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.658242941 CEST44349771142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.684411049 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.685086966 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.688323975 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.688333988 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.688571930 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.750392914 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.818270922 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.861999989 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.902591944 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:10.934767962 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:10.934798002 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.935925007 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.935936928 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.940809011 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:10.944503069 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.969652891 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:10.980794907 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.980813980 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.984371901 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.053848028 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:11.053945065 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.054135084 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.054158926 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.054302931 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.054317951 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.054440975 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:11.054510117 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.055408001 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.055423021 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.086960077 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.087013006 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.088607073 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.100490093 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.102834940 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.102849960 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.102865934 CEST49772443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.102871895 CEST44349772184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.156449080 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.156491995 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.156553030 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.156579971 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.156958103 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.159504890 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:11.167110920 CEST49773443192.168.2.4142.251.40.132
                                                                                          Aug 25, 2024 19:12:11.167133093 CEST44349773142.251.40.132192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.174937963 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.174962997 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.175128937 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.175374985 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.175386906 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.537743092 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.538062096 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.538084030 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.538435936 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.538515091 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.539149046 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.539874077 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.539928913 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.539988995 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.542646885 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.543912888 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.543925047 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.544337988 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.544521093 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.545074940 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.545706034 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.545825005 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.545886993 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.606950998 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:11.611872911 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.611943007 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:11.612097979 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:11.616914988 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.670542002 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.670542955 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.670551062 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.670559883 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.792433977 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.792434931 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.808598042 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.808672905 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.809752941 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.809762001 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.809995890 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.810928106 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:11.852505922 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.065733910 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.084101915 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.084165096 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.084276915 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:12.085406065 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:12.085419893 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.085433006 CEST49777443192.168.2.4184.28.90.27
                                                                                          Aug 25, 2024 19:12:12.085438013 CEST44349777184.28.90.27192.168.2.4
                                                                                          Aug 25, 2024 19:12:12.170412064 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:15.830110073 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:15.830137014 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:15.830207109 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:15.831208944 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:15.831221104 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:16.620827913 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:16.620917082 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:16.623611927 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:16.623621941 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:16.623847961 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:16.671629906 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.208573103 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.256504059 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.472877026 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.472896099 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.472902060 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.472913980 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.472939968 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.473001003 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.473015070 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.473037004 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.473062038 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.473799944 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.473885059 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.473896980 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.473989964 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.474042892 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.958048105 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.958067894 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:17.958080053 CEST49779443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:17.958086967 CEST4434977920.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:20.880002022 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:20.884917021 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.078183889 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:22.083022118 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.190927982 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.190962076 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.191540956 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.191786051 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.191800117 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.745253086 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.750022888 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.750039101 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.750576973 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.750596046 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.751307964 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.753556013 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.753563881 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.764832020 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.764894009 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.764959097 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.807465076 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.807472944 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862234116 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862278938 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862312078 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862332106 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862334013 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.862349033 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.862360001 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.862436056 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.863061905 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.863272905 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.863296032 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.863322973 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.863343000 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.863938093 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.863946915 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.864084959 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.864104986 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.864259005 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.864265919 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.866908073 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.867017984 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.867023945 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.907752991 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.948945045 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.948990107 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949013948 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949039936 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949068069 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949173927 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949203014 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949222088 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949245930 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949316978 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.949332952 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949428082 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.949745893 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949886084 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949909925 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949934006 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.949954987 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950052977 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950069904 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.950071096 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950082064 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950268030 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.950659037 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950946093 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.950968981 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951045990 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.951052904 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951211929 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.951245070 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951282024 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951400042 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951423883 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951452017 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951459885 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.951466084 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951493979 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951658010 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.951666117 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.951824903 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.952173948 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.952217102 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.952286959 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:22.952292919 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.992348909 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.035512924 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035564899 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035686016 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035705090 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035727978 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035754919 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035765886 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.035777092 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035818100 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035836935 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035864115 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.035866022 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035880089 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035913944 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.035914898 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.035923958 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036097050 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.036638021 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036737919 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036761999 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036784887 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036814928 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036820889 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.036828041 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036850929 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.036973000 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.036979914 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037595987 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037619114 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037646055 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037656069 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.037661076 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037687063 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037712097 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037741899 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037769079 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037792921 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.037898064 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.037908077 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038516045 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038559914 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038564920 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.038569927 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038593054 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038654089 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038681030 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038705111 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.038773060 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.038781881 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039458036 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039483070 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039516926 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039532900 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.039537907 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039566040 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039571047 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.039598942 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039624929 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039648056 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039717913 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.039725065 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.039902925 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.040353060 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.040415049 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.040497065 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:23.040606976 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.040779114 CEST49785443192.168.2.4142.251.40.97
                                                                                          Aug 25, 2024 19:12:23.040791035 CEST44349785142.251.40.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.006656885 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.006685019 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.006872892 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.007045984 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.007067919 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.508936882 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.509002924 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.509089947 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.509247065 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.509299994 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.562338114 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.562572956 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.562587023 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.563538074 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.563606024 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.564543009 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.564604998 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.564688921 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.608525038 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.610008001 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.610014915 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.663253069 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.663263083 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.663297892 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.663319111 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.663407087 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.663455963 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.671202898 CEST49786443192.168.2.4152.195.19.97
                                                                                          Aug 25, 2024 19:12:24.671211958 CEST44349786152.195.19.97192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.939688921 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.939732075 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.939865112 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.939881086 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.940608025 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.940737009 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.941026926 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.941040993 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.941143990 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:24.941171885 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.978543043 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.978599072 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.980122089 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.982768059 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.984606981 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.984683037 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.995573997 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.996407032 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.996419907 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.997538090 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.997598886 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.998636961 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:24.998692989 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.998819113 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:25.040507078 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.048938036 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:25.048971891 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.111449003 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:25.148838043 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.149063110 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.149262905 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:25.184792995 CEST49787443192.168.2.4142.251.40.106
                                                                                          Aug 25, 2024 19:12:25.184806108 CEST44349787142.251.40.106192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.411462069 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.411780119 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.412291050 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.412309885 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.412405014 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.412431002 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.412794113 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.412889004 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.413115025 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.413189888 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.413255930 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.413737059 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.413804054 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.413866997 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.456399918 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.456408024 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.456409931 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.456423998 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.541126966 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.541178942 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.541359901 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.541560888 CEST49788443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.541589975 CEST44349788162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.549321890 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.549371958 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.549432039 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.549567938 CEST49789443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.549577951 CEST44349789162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:30.887963057 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:30.892858982 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:32.095086098 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:32.101685047 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.204266071 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.204298019 CEST4434979235.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.205332041 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.207098961 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.207113981 CEST4434979235.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.207495928 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.207503080 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.207751036 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.207931042 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.207942009 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.214828968 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.214863062 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.215136051 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.215270996 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.215284109 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.390028954 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:35.390041113 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.390470982 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:35.390594959 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:35.390607119 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.677736044 CEST4434979235.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.677828074 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.682215929 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.682220936 CEST4434979235.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.682318926 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.682488918 CEST4434979235.190.72.216192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.682631016 CEST49792443192.168.2.435.190.72.216
                                                                                          Aug 25, 2024 19:12:35.684756041 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.686572075 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.686635971 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.689424992 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.689429045 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.689635038 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.690754890 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.691963911 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.692029953 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.692106009 CEST4434979335.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.692583084 CEST49793443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:35.693326950 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.698237896 CEST804977834.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.698345900 CEST4977880192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.703140974 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.703203917 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.705986023 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.705995083 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.706202984 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.708424091 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.708528996 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.708569050 CEST4434979434.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.708878040 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.708892107 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.708939075 CEST49794443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.708960056 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.709096909 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:35.709108114 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.785917044 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.786123037 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.788628101 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.791877031 CEST804977434.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.791919947 CEST4977480192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.793529034 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.793591976 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.793692112 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:35.798468113 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.110928059 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.110991955 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:36.113883972 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:36.113893032 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.114099026 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.116238117 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:36.116324902 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:36.116374016 CEST4434979552.222.236.48192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.116697073 CEST49795443192.168.2.452.222.236.48
                                                                                          Aug 25, 2024 19:12:36.123908997 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.123919964 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.124151945 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.124258041 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.124270916 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.129023075 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.132972956 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.132985115 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.133099079 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.133106947 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.133302927 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.133306026 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.133423090 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.133434057 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.133516073 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.133526087 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.133869886 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.133925915 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.134031057 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.138832092 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.186353922 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.186427116 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:36.188750982 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:36.188755035 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.189238071 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.191821098 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:36.191875935 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:36.191998005 CEST4434979634.149.100.209192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.192497969 CEST49796443192.168.2.434.149.100.209
                                                                                          Aug 25, 2024 19:12:36.257281065 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.302192926 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.588536978 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.588607073 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.591042042 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.591047049 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.591243029 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.593492031 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.593585968 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.593621969 CEST4434979835.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.594489098 CEST49798443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.599287987 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.599349022 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.600986958 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.601665020 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.601674080 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.601876020 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.604552984 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.604640961 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.604696035 CEST4434980035.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.604731083 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.606015921 CEST49800443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.608865976 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.612288952 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.613070965 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.613125086 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.614093065 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.615525007 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.615529060 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.615722895 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.617799044 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.617855072 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.617921114 CEST4434980135.244.181.201192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.618266106 CEST49801443192.168.2.435.244.181.201
                                                                                          Aug 25, 2024 19:12:36.706343889 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.707938910 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.710047007 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.714889050 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.756722927 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:36.808352947 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:36.856997967 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:46.715416908 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:46.720490932 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:46.815908909 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:46.820776939 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:54.787502050 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:54.787539005 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:54.787606955 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:54.787919044 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:54.787935019 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.593120098 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.593195915 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.596436024 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.596443892 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.596874952 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.603830099 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.648503065 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.930138111 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.930207014 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.930252075 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.930282116 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.930294991 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.930314064 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.930376053 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.931340933 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.931392908 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.931405067 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.931410074 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.931442976 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.931459904 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.931509018 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.931575060 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.932925940 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.935101032 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.935112953 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:55.935127020 CEST49803443192.168.2.420.114.59.183
                                                                                          Aug 25, 2024 19:12:55.935132027 CEST4434980320.114.59.183192.168.2.4
                                                                                          Aug 25, 2024 19:12:56.675023079 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:56.675024033 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:56.675036907 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:56.675044060 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:56.721199989 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:56.726073980 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:12:56.828969002 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:12:56.834018946 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:04.812608957 CEST49769443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:04.812632084 CEST44349769172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:04.812658072 CEST49768443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:04.812683105 CEST44349768172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.267147064 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.267167091 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.267390966 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.267396927 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.267621994 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.267695904 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.270365953 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270390034 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270390987 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270534992 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270550966 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.270646095 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270657063 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.270735025 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.270771980 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.577933073 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:05.577965975 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.578038931 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:05.578255892 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:05.578269958 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.731034994 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.731106043 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.731127977 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.731256962 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.734210014 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.734217882 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.734438896 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.737081051 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.737104893 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.737353086 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.739851952 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.739974976 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.740020990 CEST4434980634.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.740175962 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.740245104 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.740345001 CEST4434980734.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.740664005 CEST49806443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.740683079 CEST49807443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.763289928 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.763353109 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.860043049 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.860054016 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.860940933 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.863948107 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.864037037 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.864192963 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:05.864340067 CEST4434980534.120.208.123192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.864957094 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.864969015 CEST49805443192.168.2.434.120.208.123
                                                                                          Aug 25, 2024 19:13:05.869914055 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.966502905 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.969563007 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:05.974410057 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.016416073 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:06.059429884 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.059705019 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.059715033 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.060045958 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.060714960 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.060775995 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.060875893 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.067533016 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.104507923 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.110888004 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.110898972 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:06.312375069 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.312448025 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.312508106 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.312783957 CEST49808443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.312800884 CEST4434980823.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.313508034 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.313545942 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.323309898 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.323477983 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.323489904 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.807260036 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.815843105 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.815861940 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.816175938 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.822084904 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.822140932 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.822215080 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.862024069 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:06.862030983 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.024759054 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.024817944 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.025372982 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:07.025563002 CEST49809443192.168.2.423.44.133.57
                                                                                          Aug 25, 2024 19:13:07.025574923 CEST4434980923.44.133.57192.168.2.4
                                                                                          Aug 25, 2024 19:13:10.989547014 CEST4972380192.168.2.493.184.221.240
                                                                                          Aug 25, 2024 19:13:10.989613056 CEST4972480192.168.2.493.184.221.240
                                                                                          Aug 25, 2024 19:13:10.994832993 CEST804972393.184.221.240192.168.2.4
                                                                                          Aug 25, 2024 19:13:10.994894028 CEST4972380192.168.2.493.184.221.240
                                                                                          Aug 25, 2024 19:13:10.998837948 CEST804972493.184.221.240192.168.2.4
                                                                                          Aug 25, 2024 19:13:10.999700069 CEST4972480192.168.2.493.184.221.240
                                                                                          Aug 25, 2024 19:13:15.971019030 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:15.976485014 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:16.071301937 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:16.076237917 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:25.981472015 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:25.986519098 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:26.077250957 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:26.082915068 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:35.987060070 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:35.992072105 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:36.087274075 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:36.092407942 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:41.687731028 CEST49776443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:13:41.687731981 CEST49775443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:13:41.687747002 CEST44349775142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:13:41.687747955 CEST44349776142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:13:46.000858068 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:46.008557081 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:46.102947950 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:46.109884024 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:56.010298967 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:56.015352011 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:13:56.110641956 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:13:56.115540028 CEST804979734.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:14:06.018014908 CEST4979980192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:14:06.023427963 CEST804979934.107.221.82192.168.2.4
                                                                                          Aug 25, 2024 19:14:06.128259897 CEST4979780192.168.2.434.107.221.82
                                                                                          Aug 25, 2024 19:14:06.133366108 CEST804979734.107.221.82192.168.2.4

                                                                                          UDP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Aug 25, 2024 19:12:03.208970070 CEST53556201.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:04.805759907 CEST5086453192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:04.806027889 CEST5821653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:05.747601032 CEST53506981.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:06.895199060 CEST53499571.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.364080906 CEST53543541.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.989418030 CEST5748253192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.989557028 CEST6228453192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.989867926 CEST5256853192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.989974976 CEST6276653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:07.996455908 CEST53622841.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.996552944 CEST53574821.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.996747971 CEST53525681.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:07.996777058 CEST53627661.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.133533001 CEST4930953192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:08.133697987 CEST5052453192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:08.140645981 CEST53505241.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:08.141118050 CEST53493091.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.228509903 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.346021891 CEST6096653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:09.354243040 CEST53609661.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.370492935 CEST5740253192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:09.383450985 CEST53574021.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.603123903 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.700398922 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.700413942 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.700431108 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.700445890 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.702050924 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.707573891 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.710289955 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.710591078 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.710705996 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.710928917 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.711101055 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.806562901 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.806576967 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.806735039 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.806747913 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.807400942 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.807569027 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.808340073 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.808983088 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.810414076 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.813734055 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.903450012 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.903665066 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:09.903712988 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:09.961205959 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.000837088 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.001305103 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.001619101 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.005096912 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.243503094 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.243628979 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.343358994 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.344590902 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.344604015 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.346352100 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:10.383150101 CEST6119053192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:10.392779112 CEST6325653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:10.399712086 CEST53632561.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.407632113 CEST6059953192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:10.415045977 CEST53605991.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:10.627127886 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:10.977022886 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.081589937 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.081635952 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.084271908 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.087872982 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.087912083 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.087924004 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.087934971 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.092072964 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.092536926 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.099694014 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.099802971 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.100177050 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.100177050 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.108830929 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.198434114 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.198682070 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.199178934 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.199666023 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.207860947 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.212903023 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.214351892 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.214680910 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.214813948 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.221692085 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.222084999 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.225311995 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.252433062 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:11.323988914 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.594042063 CEST5700953192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:11.597479105 CEST6338753192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:11.598346949 CEST4984353192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:11.601603985 CEST53570091.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:11.605566978 CEST53633871.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:19.028002977 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:19.028039932 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:19.127264977 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:19.156881094 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:19.164144993 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:19.164180040 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:19.164408922 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:19.210074902 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:19.288574934 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.080391884 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:22.080504894 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:22.177627087 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.178488016 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.187747955 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:22.190499067 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:22.679783106 CEST138138192.168.2.4192.168.2.255
                                                                                          Aug 25, 2024 19:12:23.906351089 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:23.906461000 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.003848076 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.005503893 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.005909920 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.006166935 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.408193111 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.408416986 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.504960060 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.506109953 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.506762981 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:24.508291006 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.937516928 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.937997103 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:24.939174891 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.035393953 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.036225080 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.036544085 CEST44349682172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.037642956 CEST49682443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:12:25.256159067 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.418838978 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.419223070 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.419234991 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.419240952 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.419250965 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.419534922 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.421315908 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.421416044 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.516772985 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.516912937 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.516921997 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.516930103 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.518312931 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.518387079 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:25.613672972 CEST44357632162.159.61.3192.168.2.4
                                                                                          Aug 25, 2024 19:12:25.641448975 CEST57632443192.168.2.4162.159.61.3
                                                                                          Aug 25, 2024 19:12:35.204905033 CEST5670153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.206640005 CEST5030653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.213346004 CEST53567011.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.214262962 CEST53503061.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.214927912 CEST5015653192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.215861082 CEST5868853192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.222573042 CEST53586881.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.229063988 CEST53501561.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.229640961 CEST6316153192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.236985922 CEST53631611.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.379900932 CEST5507853192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.389271975 CEST53550781.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.390417099 CEST6399953192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.406712055 CEST53639991.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:35.407285929 CEST5734253192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:12:35.416466951 CEST53573421.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:12:39.999500990 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:40.166457891 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:40.235483885 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:40.235918999 CEST63854443192.168.2.4142.250.176.206
                                                                                          Aug 25, 2024 19:12:40.269134045 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:12:40.334553957 CEST44363854142.250.176.206192.168.2.4
                                                                                          Aug 25, 2024 19:13:04.813455105 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:04.813606977 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:04.813785076 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:04.813873053 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.268084049 CEST4990953192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:13:05.273993969 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.274471045 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.277436018 CEST53499091.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.278585911 CEST5461353192.168.2.41.1.1.1
                                                                                          Aug 25, 2024 19:13:05.287612915 CEST53546131.1.1.1192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.313160896 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.376586914 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.376610041 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.376620054 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.376630068 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.376884937 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.376949072 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.475495100 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.476125956 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:05.575557947 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.577059031 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.577069044 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:05.577327013 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:06.816757917 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:06.816850901 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:06.918567896 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.920059919 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.920134068 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:06.923810005 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:06.925013065 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.232155085 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.413768053 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.417098045 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.417223930 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.417236090 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.417243004 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.417534113 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.419579983 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.419687986 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.521442890 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.521749973 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.521759033 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.521769047 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.521776915 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:07.521927118 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.522062063 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:07.617075920 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.026422024 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:09.026518106 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:09.126353025 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.127540112 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.127747059 CEST44364234172.64.41.3192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.130490065 CEST64234443192.168.2.4172.64.41.3
                                                                                          Aug 25, 2024 19:13:09.131088972 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.131189108 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.131364107 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.596935034 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.596949100 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.596963882 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.596975088 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.596987009 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.597337008 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.598005056 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.697947025 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.697957039 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.698249102 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.721915960 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.721925974 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.721935034 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:09.722330093 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.756531954 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:09.847572088 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:12.036933899 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:12.161411047 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:12.178992033 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:12.179003000 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:12.179009914 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:12.179239988 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:12.180365086 CEST55610443192.168.2.4142.251.16.84
                                                                                          Aug 25, 2024 19:13:12.303725004 CEST44355610142.251.16.84192.168.2.4
                                                                                          Aug 25, 2024 19:13:27.521806955 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:27.550983906 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:28.022910118 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:13:28.051529884 CEST64251443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:13:37.522414923 CEST4436425123.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:06.883326054 CEST61385443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:14:07.337308884 CEST4436138523.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:07.337323904 CEST4436138523.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:07.338125944 CEST61385443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:14:07.438538074 CEST4436138523.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:07.438564062 CEST4436138523.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:07.438572884 CEST4436138523.219.82.19192.168.2.4
                                                                                          Aug 25, 2024 19:14:07.438904047 CEST61385443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:14:07.464226007 CEST61385443192.168.2.423.219.82.19
                                                                                          Aug 25, 2024 19:14:07.539398909 CEST4436138523.219.82.19192.168.2.4

                                                                                          DNS Queries

                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                          Aug 25, 2024 19:12:04.805759907 CEST192.168.2.41.1.1.10x9573Standard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:04.806027889 CEST192.168.2.41.1.1.10x2d19Standard query (0)bzib.nelreports.net65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.989418030 CEST192.168.2.41.1.1.10x45a0Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.989557028 CEST192.168.2.41.1.1.10x62e8Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.989867926 CEST192.168.2.41.1.1.10xa6ecStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.989974976 CEST192.168.2.41.1.1.10xc669Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.133533001 CEST192.168.2.41.1.1.10x1796Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.133697987 CEST192.168.2.41.1.1.10x4109Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.346021891 CEST192.168.2.41.1.1.10x5e1eStandard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.370492935 CEST192.168.2.41.1.1.10x4007Standard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.383150101 CEST192.168.2.41.1.1.10x6c95Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.392779112 CEST192.168.2.41.1.1.10xbaefStandard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.407632113 CEST192.168.2.41.1.1.10xd00eStandard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.594042063 CEST192.168.2.41.1.1.10xa2ecStandard query (0)example.orgA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.597479105 CEST192.168.2.41.1.1.10x5a4dStandard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.598346949 CEST192.168.2.41.1.1.10xffd5Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.204905033 CEST192.168.2.41.1.1.10x4d56Standard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.206640005 CEST192.168.2.41.1.1.10xe2d8Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.214927912 CEST192.168.2.41.1.1.10x5ab4Standard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.215861082 CEST192.168.2.41.1.1.10x10bbStandard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.229640961 CEST192.168.2.41.1.1.10xca30Standard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.379900932 CEST192.168.2.41.1.1.10xe585Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.390417099 CEST192.168.2.41.1.1.10x7f42Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.407285929 CEST192.168.2.41.1.1.10xefbcStandard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                                                          Aug 25, 2024 19:13:05.268084049 CEST192.168.2.41.1.1.10xa249Standard query (0)telemetry-incoming.r53-2.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:13:05.278585911 CEST192.168.2.41.1.1.10x8dbdStandard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false

                                                                                          DNS Answers

                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                          Aug 25, 2024 19:12:04.813174963 CEST1.1.1.1192.168.2.40x9573No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:04.816083908 CEST1.1.1.1192.168.2.40x2d19No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:06.895144939 CEST1.1.1.1192.168.2.40x7e05No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:06.895144939 CEST1.1.1.1192.168.2.40x7e05No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:06.909670115 CEST1.1.1.1192.168.2.40x76c2No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.896713972 CEST1.1.1.1192.168.2.40x9451No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.896713972 CEST1.1.1.1192.168.2.40x9451No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.897720098 CEST1.1.1.1192.168.2.40xf073No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996455908 CEST1.1.1.1192.168.2.40x62e8No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996552944 CEST1.1.1.1192.168.2.40x45a0No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996552944 CEST1.1.1.1192.168.2.40x45a0No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996747971 CEST1.1.1.1192.168.2.40xa6ecNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996747971 CEST1.1.1.1192.168.2.40xa6ecNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:07.996777058 CEST1.1.1.1192.168.2.40xc669No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.140645981 CEST1.1.1.1192.168.2.40x4109No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.141118050 CEST1.1.1.1192.168.2.40x1796No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.141118050 CEST1.1.1.1192.168.2.40x1796No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.158312082 CEST1.1.1.1192.168.2.40xe1f2No error (0)shed.dual-low.s-part-0039.t-0009.t-msedge.nets-part-0039.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:08.158312082 CEST1.1.1.1192.168.2.40xe1f2No error (0)s-part-0039.t-0009.t-msedge.net13.107.246.67A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.323930979 CEST1.1.1.1192.168.2.40x8dc0No error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.354243040 CEST1.1.1.1192.168.2.40x5e1eNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.930917978 CEST1.1.1.1192.168.2.40x6cd3No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:09.930917978 CEST1.1.1.1192.168.2.40x6cd3No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.391299009 CEST1.1.1.1192.168.2.40x6c95No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.391299009 CEST1.1.1.1192.168.2.40x6c95No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.399712086 CEST1.1.1.1192.168.2.40xbaefNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:10.415045977 CEST1.1.1.1192.168.2.40xd00eNo error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.076417923 CEST1.1.1.1192.168.2.40x6cd3No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.076417923 CEST1.1.1.1192.168.2.40x6cd3No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.601603985 CEST1.1.1.1192.168.2.40xa2ecNo error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.605566978 CEST1.1.1.1192.168.2.40x5a4dNo error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.605566978 CEST1.1.1.1192.168.2.40x5a4dNo error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.606189966 CEST1.1.1.1192.168.2.40xffd5No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:11.606189966 CEST1.1.1.1192.168.2.40xffd5No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:12.078068018 CEST1.1.1.1192.168.2.40x6cd3No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:12.078068018 CEST1.1.1.1192.168.2.40x6cd3No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:14.085772991 CEST1.1.1.1192.168.2.40x6cd3No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:14.085772991 CEST1.1.1.1192.168.2.40x6cd3No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:18.083678961 CEST1.1.1.1192.168.2.40x6cd3No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:18.083678961 CEST1.1.1.1192.168.2.40x6cd3No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.204320908 CEST1.1.1.1192.168.2.40xa942No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.204320908 CEST1.1.1.1192.168.2.40xa942No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.213346004 CEST1.1.1.1192.168.2.40x4d56No error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.213346004 CEST1.1.1.1192.168.2.40x4d56No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.214262962 CEST1.1.1.1192.168.2.40xe2d8No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.229063988 CEST1.1.1.1192.168.2.40x5ab4No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.389271975 CEST1.1.1.1192.168.2.40xe585No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.389271975 CEST1.1.1.1192.168.2.40xe585No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.389271975 CEST1.1.1.1192.168.2.40xe585No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.389271975 CEST1.1.1.1192.168.2.40xe585No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.406712055 CEST1.1.1.1192.168.2.40x7f42No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.406712055 CEST1.1.1.1192.168.2.40x7f42No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.406712055 CEST1.1.1.1192.168.2.40x7f42No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:35.406712055 CEST1.1.1.1192.168.2.40x7f42No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:36.132325888 CEST1.1.1.1192.168.2.40x7149No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:36.132325888 CEST1.1.1.1192.168.2.40x7149No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:36.656557083 CEST1.1.1.1192.168.2.40xf87cNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:12:36.656557083 CEST1.1.1.1192.168.2.40xf87cNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                          Aug 25, 2024 19:13:05.182547092 CEST1.1.1.1192.168.2.40x696dNo error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                          Aug 25, 2024 19:13:05.277436018 CEST1.1.1.1192.168.2.40xa249No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false

                                                                                          HTTP Request Dependency Graph

                                                                                          • chrome.cloudflare-dns.com
                                                                                          • edgeassetservice.azureedge.net
                                                                                          • https:
                                                                                            • www.google.com
                                                                                          • fs.microsoft.com
                                                                                          • slscr.update.microsoft.com
                                                                                          • clients2.googleusercontent.com
                                                                                          • msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                                                          • www.googleapis.com
                                                                                          • bzib.nelreports.net
                                                                                          • detectportal.firefox.com

                                                                                          HTTP Packets

                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          0192.168.2.44977434.107.221.82806352C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Aug 25, 2024 19:12:10.397538900 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Connection: keep-alive
                                                                                          Aug 25, 2024 19:12:10.861999989 CEST298INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 90
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 03:07:54 GMT
                                                                                          Age: 50656
                                                                                          Content-Type: text/html
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                          Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                          Aug 25, 2024 19:12:20.880002022 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:12:30.887963057 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:12:35.684756041 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Connection: keep-alive
                                                                                          Aug 25, 2024 19:12:35.785917044 CEST298INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 90
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 03:07:54 GMT
                                                                                          Age: 50681
                                                                                          Content-Type: text/html
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                          Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          1192.168.2.44977834.107.221.82806352C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Aug 25, 2024 19:12:11.612097979 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Connection: keep-alive
                                                                                          Pragma: no-cache
                                                                                          Cache-Control: no-cache
                                                                                          Aug 25, 2024 19:12:12.065733910 CEST216INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 8
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 00:08:17 GMT
                                                                                          Age: 61435
                                                                                          Content-Type: text/plain
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 73 75 63 63 65 73 73 0a
                                                                                          Data Ascii: success
                                                                                          Aug 25, 2024 19:12:22.078183889 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:12:32.095086098 CEST6OUTData Raw: 00
                                                                                          Data Ascii:


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          2192.168.2.44979734.107.221.82806352C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Aug 25, 2024 19:12:35.793692112 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Connection: keep-alive
                                                                                          Pragma: no-cache
                                                                                          Cache-Control: no-cache
                                                                                          Aug 25, 2024 19:12:36.257281065 CEST216INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 8
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 00:08:17 GMT
                                                                                          Age: 61459
                                                                                          Content-Type: text/plain
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 73 75 63 63 65 73 73 0a
                                                                                          Data Ascii: success
                                                                                          Aug 25, 2024 19:12:36.604731083 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Connection: keep-alive
                                                                                          Pragma: no-cache
                                                                                          Cache-Control: no-cache
                                                                                          Aug 25, 2024 19:12:36.706343889 CEST216INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 8
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 00:08:17 GMT
                                                                                          Age: 61459
                                                                                          Content-Type: text/plain
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 73 75 63 63 65 73 73 0a
                                                                                          Data Ascii: success
                                                                                          Aug 25, 2024 19:12:36.710047007 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Connection: keep-alive
                                                                                          Pragma: no-cache
                                                                                          Cache-Control: no-cache
                                                                                          Aug 25, 2024 19:12:36.808352947 CEST216INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 8
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 00:08:17 GMT
                                                                                          Age: 61459
                                                                                          Content-Type: text/plain
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 73 75 63 63 65 73 73 0a
                                                                                          Data Ascii: success
                                                                                          Aug 25, 2024 19:12:46.815908909 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:12:56.828969002 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:05.969563007 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Connection: keep-alive
                                                                                          Pragma: no-cache
                                                                                          Cache-Control: no-cache
                                                                                          Aug 25, 2024 19:13:06.067533016 CEST216INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 8
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 00:08:17 GMT
                                                                                          Age: 61489
                                                                                          Content-Type: text/plain
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 73 75 63 63 65 73 73 0a
                                                                                          Data Ascii: success
                                                                                          Aug 25, 2024 19:13:16.071301937 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:26.077250957 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:36.087274075 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:46.102947950 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:56.110641956 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:14:06.128259897 CEST6OUTData Raw: 00
                                                                                          Data Ascii:


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          3192.168.2.44979934.107.221.82806352C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          Aug 25, 2024 19:12:36.134031057 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Connection: keep-alive
                                                                                          Aug 25, 2024 19:12:36.600986958 CEST297INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 90
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 15:03:14 GMT
                                                                                          Age: 7762
                                                                                          Content-Type: text/html
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                          Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                          Aug 25, 2024 19:12:36.608865976 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Connection: keep-alive
                                                                                          Aug 25, 2024 19:12:36.707938910 CEST297INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 90
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 15:03:14 GMT
                                                                                          Age: 7762
                                                                                          Content-Type: text/html
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                          Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                          Aug 25, 2024 19:12:46.715416908 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:12:56.721199989 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:05.864192963 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                          Host: detectportal.firefox.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                          Accept: */*
                                                                                          Accept-Language: en-US,en;q=0.5
                                                                                          Accept-Encoding: gzip, deflate
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Connection: keep-alive
                                                                                          Aug 25, 2024 19:13:05.966502905 CEST297INHTTP/1.1 200 OK
                                                                                          Server: nginx
                                                                                          Content-Length: 90
                                                                                          Via: 1.1 google
                                                                                          Date: Sun, 25 Aug 2024 15:03:14 GMT
                                                                                          Age: 7791
                                                                                          Content-Type: text/html
                                                                                          Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                          Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                          Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                          Aug 25, 2024 19:13:15.971019030 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:25.981472015 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:35.987060070 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:46.000858068 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:13:56.010298967 CEST6OUTData Raw: 00
                                                                                          Data Ascii:
                                                                                          Aug 25, 2024 19:14:06.018014908 CEST6OUTData Raw: 00
                                                                                          Data Ascii:


                                                                                          HTTPS Proxied Packets

                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          0192.168.2.449761162.159.61.34437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                          Host: chrome.cloudflare-dns.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 128
                                                                                          Accept: application/dns-message
                                                                                          Accept-Language: *
                                                                                          User-Agent: Chrome
                                                                                          Accept-Encoding: identity
                                                                                          Content-Type: application/dns-message
                                                                                          2024-08-25 17:12:08 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                          2024-08-25 17:12:08 UTC247INHTTP/1.1 200 OK
                                                                                          Server: cloudflare
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/dns-message
                                                                                          Connection: close
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Content-Length: 468
                                                                                          CF-RAY: 8b8d348d491f8c23-EWR
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          2024-08-25 17:12:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcomQ)


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          1192.168.2.449762172.64.41.34437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                          Host: chrome.cloudflare-dns.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 128
                                                                                          Accept: application/dns-message
                                                                                          Accept-Language: *
                                                                                          User-Agent: Chrome
                                                                                          Accept-Encoding: identity
                                                                                          Content-Type: application/dns-message
                                                                                          2024-08-25 17:12:08 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                          2024-08-25 17:12:08 UTC247INHTTP/1.1 200 OK
                                                                                          Server: cloudflare
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/dns-message
                                                                                          Connection: close
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Content-Length: 468
                                                                                          CF-RAY: 8b8d348d7d8c19fb-EWR
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          2024-08-25 17:12:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ca 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcomP#)


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          2192.168.2.449763172.64.41.34437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                          Host: chrome.cloudflare-dns.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 128
                                                                                          Accept: application/dns-message
                                                                                          Accept-Language: *
                                                                                          User-Agent: Chrome
                                                                                          Accept-Encoding: identity
                                                                                          Content-Type: application/dns-message
                                                                                          2024-08-25 17:12:08 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcom)TP
                                                                                          2024-08-25 17:12:08 UTC247INHTTP/1.1 200 OK
                                                                                          Server: cloudflare
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/dns-message
                                                                                          Connection: close
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Content-Length: 468
                                                                                          CF-RAY: 8b8d348e5e5219e7-EWR
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          2024-08-25 17:12:08 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: wwwgstaticcom c)


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          3192.168.2.44976513.107.246.674437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC711OUTGET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1
                                                                                          Host: edgeassetservice.azureedge.net
                                                                                          Connection: keep-alive
                                                                                          Edge-Asset-Group: EntityExtractionDomainsConfig
                                                                                          Sec-Mesh-Client-Edge-Version: 117.0.2045.47
                                                                                          Sec-Mesh-Client-Edge-Channel: stable
                                                                                          Sec-Mesh-Client-OS: Windows
                                                                                          Sec-Mesh-Client-OS-Version: 10.0.19045
                                                                                          Sec-Mesh-Client-Arch: x86_64
                                                                                          Sec-Mesh-Client-WebView: 0
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:08 UTC583INHTTP/1.1 200 OK
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/octet-stream
                                                                                          Content-Length: 70207
                                                                                          Connection: close
                                                                                          Content-Encoding: gzip
                                                                                          Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT
                                                                                          ETag: 0x8DCB31E67C22927
                                                                                          x-ms-request-id: 14c701d7-e01e-0029-02e8-f61e45000000
                                                                                          x-ms-version: 2009-09-19
                                                                                          x-ms-lease-status: unlocked
                                                                                          x-ms-blob-type: BlockBlob
                                                                                          x-azure-ref: 20240825T171208Z-15c77d89844678z85cxpgnswe00000000e8g0000000058fu
                                                                                          Cache-Control: public, max-age=604800
                                                                                          x-fd-int-roxy-purgeid: 69316365
                                                                                          X-Cache: TCP_HIT
                                                                                          X-Cache-Info: L1_T2
                                                                                          Accept-Ranges: bytes
                                                                                          2024-08-25 17:12:08 UTC15801INData Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7
                                                                                          Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31
                                                                                          Data Ascii: JEq*b,0Rte*|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;|a``|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63
                                                                                          Data Ascii: /M5?Rg|M kt|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX*$Nkct&iZ%b8Zoj@ u2OgA1DG3*5d*lg|9GV>OVzVMPA76.|c
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81
                                                                                          Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
                                                                                          2024-08-25 17:12:09 UTC5254INData Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83
                                                                                          Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          4192.168.2.44976413.107.246.674437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC486OUTGET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1
                                                                                          Host: edgeassetservice.azureedge.net
                                                                                          Connection: keep-alive
                                                                                          Edge-Asset-Group: ArbitrationService
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:08 UTC559INHTTP/1.1 200 OK
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/octet-stream
                                                                                          Content-Length: 11989
                                                                                          Connection: close
                                                                                          Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT
                                                                                          ETag: 0x8DCC30802EF150E
                                                                                          x-ms-request-id: 9d463e20-501e-0019-7d06-f5446f000000
                                                                                          x-ms-version: 2009-09-19
                                                                                          x-ms-lease-status: unlocked
                                                                                          x-ms-blob-type: BlockBlob
                                                                                          x-azure-ref: 20240825T171208Z-15c77d89844n6dtp5f09y9f4c80000000fh000000000n3mc
                                                                                          Cache-Control: public, max-age=604800
                                                                                          x-fd-int-roxy-purgeid: 69316365
                                                                                          X-Cache: TCP_HIT
                                                                                          X-Cache-Info: L1_T2
                                                                                          Accept-Ranges: bytes
                                                                                          2024-08-25 17:12:08 UTC11989INData Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45
                                                                                          Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          5192.168.2.44976613.107.246.674437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:08 UTC470OUTGET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1
                                                                                          Host: edgeassetservice.azureedge.net
                                                                                          Connection: keep-alive
                                                                                          Edge-Asset-Group: Shoreline
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:08 UTC584INHTTP/1.1 200 OK
                                                                                          Date: Sun, 25 Aug 2024 17:12:08 GMT
                                                                                          Content-Type: application/octet-stream
                                                                                          Content-Length: 306698
                                                                                          Connection: close
                                                                                          Content-Encoding: gzip
                                                                                          Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT
                                                                                          ETag: 0x8DBC9B5C40EBFF4
                                                                                          x-ms-request-id: 996e2297-301e-0064-6384-f5d8a7000000
                                                                                          x-ms-version: 2009-09-19
                                                                                          x-ms-lease-status: unlocked
                                                                                          x-ms-blob-type: BlockBlob
                                                                                          x-azure-ref: 20240825T171208Z-15c77d89844kcg9tenmhtd29e40000000bm000000000gp8e
                                                                                          Cache-Control: public, max-age=604800
                                                                                          x-fd-int-roxy-purgeid: 69316365
                                                                                          X-Cache: TCP_HIT
                                                                                          X-Cache-Info: L1_T2
                                                                                          Accept-Ranges: bytes
                                                                                          2024-08-25 17:12:08 UTC15800INData Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe
                                                                                          Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&|'J'~eL|&c~6{JAw^z3cUEeMaTu W/^~b|X_?r~vXwW
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61
                                                                                          Data Ascii: 8}u&U\h|[T[%6Q+"PR6mU5YgV-HoB /!~qL|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz|PVM&UOu~{-oM5Qa
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2
                                                                                          Data Ascii: Vu,(T$&O7gkD$>U|}mlBxz*BFSzP~|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)|[U35Q
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8
                                                                                          Data Ascii: >6jg~*B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:*_Gp`n3.e_j;`?ihbE}*Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43
                                                                                          Data Ascii: .kp4k@?lk/IyMR\!1Q|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0o*j~~{Y1U}n|?*4>tk,OS]|w}:)y7gg3r#YU]oU~C
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c
                                                                                          Data Ascii: &{M1eIwyfr;Tt5S};PtEr~*uVOLC=A{5__p*tHt|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e
                                                                                          Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3
                                                                                          Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48
                                                                                          Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;|.'Ocl7vUh&n{G]%vH
                                                                                          2024-08-25 17:12:09 UTC16384INData Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25
                                                                                          Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`|'5Z:-#BoFX1-3JESJY(bJX*@D[93&Pq<jy@^2%


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          6192.168.2.449770142.250.176.2064437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:10 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                          Host: play.google.com
                                                                                          Connection: keep-alive
                                                                                          Accept: */*
                                                                                          Access-Control-Request-Method: POST
                                                                                          Access-Control-Request-Headers: x-goog-authuser
                                                                                          Origin: https://accounts.google.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Sec-Fetch-Mode: cors
                                                                                          Sec-Fetch-Site: same-site
                                                                                          Sec-Fetch-Dest: empty
                                                                                          Referer: https://accounts.google.com/
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:10 UTC520INHTTP/1.1 200 OK
                                                                                          Access-Control-Allow-Origin: https://accounts.google.com
                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                          Access-Control-Max-Age: 86400
                                                                                          Access-Control-Allow-Credentials: true
                                                                                          Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                          Date: Sun, 25 Aug 2024 17:12:10 GMT
                                                                                          Server: Playlog
                                                                                          Content-Length: 0
                                                                                          X-XSS-Protection: 0
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                          Connection: close


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          7192.168.2.449771142.250.176.2064437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:10 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                                                          Host: play.google.com
                                                                                          Connection: keep-alive
                                                                                          Accept: */*
                                                                                          Access-Control-Request-Method: POST
                                                                                          Access-Control-Request-Headers: x-goog-authuser
                                                                                          Origin: https://accounts.google.com
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Sec-Fetch-Mode: cors
                                                                                          Sec-Fetch-Site: same-site
                                                                                          Sec-Fetch-Dest: empty
                                                                                          Referer: https://accounts.google.com/
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:10 UTC520INHTTP/1.1 200 OK
                                                                                          Access-Control-Allow-Origin: https://accounts.google.com
                                                                                          Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                          Access-Control-Max-Age: 86400
                                                                                          Access-Control-Allow-Credentials: true
                                                                                          Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                          Date: Sun, 25 Aug 2024 17:12:10 GMT
                                                                                          Server: Playlog
                                                                                          Content-Length: 0
                                                                                          X-XSS-Protection: 0
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                          Connection: close


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          8192.168.2.449772184.28.90.27443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:10 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                                                          Connection: Keep-Alive
                                                                                          Accept: */*
                                                                                          Accept-Encoding: identity
                                                                                          User-Agent: Microsoft BITS/7.8
                                                                                          Host: fs.microsoft.com
                                                                                          2024-08-25 17:12:11 UTC467INHTTP/1.1 200 OK
                                                                                          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                          Content-Type: application/octet-stream
                                                                                          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                          Server: ECAcc (lpl/EF17)
                                                                                          X-CID: 11
                                                                                          X-Ms-ApiVersion: Distribute 1.2
                                                                                          X-Ms-Region: prod-weu-z1
                                                                                          Cache-Control: public, max-age=253696
                                                                                          Date: Sun, 25 Aug 2024 17:12:10 GMT
                                                                                          Connection: close
                                                                                          X-CID: 2


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          9192.168.2.449773142.251.40.1324437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:11 UTC899OUTGET /favicon.ico HTTP/1.1
                                                                                          Host: www.google.com
                                                                                          Connection: keep-alive
                                                                                          sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                                                          sec-ch-ua-mobile: ?0
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          sec-ch-ua-arch: "x86"
                                                                                          sec-ch-ua-full-version: "117.0.2045.47"
                                                                                          sec-ch-ua-platform-version: "10.0.0"
                                                                                          sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                                                          sec-ch-ua-bitness: "64"
                                                                                          sec-ch-ua-model: ""
                                                                                          sec-ch-ua-wow64: ?0
                                                                                          sec-ch-ua-platform: "Windows"
                                                                                          Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                          Sec-Fetch-Site: same-site
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: image
                                                                                          Referer: https://accounts.google.com/
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:11 UTC705INHTTP/1.1 200 OK
                                                                                          Accept-Ranges: bytes
                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                          Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                                                          Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                                                          Content-Length: 5430
                                                                                          X-Content-Type-Options: nosniff
                                                                                          Server: sffe
                                                                                          X-XSS-Protection: 0
                                                                                          Date: Sun, 25 Aug 2024 16:25:13 GMT
                                                                                          Expires: Mon, 02 Sep 2024 16:25:13 GMT
                                                                                          Cache-Control: public, max-age=691200
                                                                                          Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                                                          Content-Type: image/x-icon
                                                                                          Vary: Accept-Encoding
                                                                                          Age: 2818
                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                          Connection: close
                                                                                          2024-08-25 17:12:11 UTC685INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                                                          Data Ascii: h& ( 0.v]X:X:rY
                                                                                          2024-08-25 17:12:11 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a
                                                                                          Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                                                          2024-08-25 17:12:11 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff
                                                                                          Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                                                          2024-08-25 17:12:11 UTC1390INData Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                          Data Ascii: BBBBBBF!4I
                                                                                          2024-08-25 17:12:11 UTC575INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                          Data Ascii: $'


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          10192.168.2.449777184.28.90.27443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:11 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                                                          Connection: Keep-Alive
                                                                                          Accept: */*
                                                                                          Accept-Encoding: identity
                                                                                          If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                                                          Range: bytes=0-2147483646
                                                                                          User-Agent: Microsoft BITS/7.8
                                                                                          Host: fs.microsoft.com
                                                                                          2024-08-25 17:12:12 UTC515INHTTP/1.1 200 OK
                                                                                          ApiVersion: Distribute 1.1
                                                                                          Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                                                          Content-Type: application/octet-stream
                                                                                          ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                                                          Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                                                          Server: ECAcc (lpl/EF06)
                                                                                          X-CID: 11
                                                                                          X-Ms-ApiVersion: Distribute 1.2
                                                                                          X-Ms-Region: prod-weu-z1
                                                                                          Cache-Control: public, max-age=257609
                                                                                          Date: Sun, 25 Aug 2024 17:12:11 GMT
                                                                                          Content-Length: 55
                                                                                          Connection: close
                                                                                          X-CID: 2
                                                                                          2024-08-25 17:12:12 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                                                          Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          11192.168.2.44977920.114.59.183443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:17 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDoZ+7e+4bO81aT&MD=hDGSuHOy HTTP/1.1
                                                                                          Connection: Keep-Alive
                                                                                          Accept: */*
                                                                                          User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                          Host: slscr.update.microsoft.com
                                                                                          2024-08-25 17:12:17 UTC560INHTTP/1.1 200 OK
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Content-Type: application/octet-stream
                                                                                          Expires: -1
                                                                                          Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                          ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                                                          MS-CorrelationId: 540b3a87-3d09-4749-8468-0571f9dc53d0
                                                                                          MS-RequestId: 1620faae-7e1f-491c-b0af-896d704566c4
                                                                                          MS-CV: et/CJHws6kKGj5ky.0
                                                                                          X-Microsoft-SLSClientCache: 2880
                                                                                          Content-Disposition: attachment; filename=environment.cab
                                                                                          X-Content-Type-Options: nosniff
                                                                                          Date: Sun, 25 Aug 2024 17:12:16 GMT
                                                                                          Connection: close
                                                                                          Content-Length: 24490
                                                                                          2024-08-25 17:12:17 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                                                          Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                                                          2024-08-25 17:12:17 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                                                          Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          12192.168.2.449785142.251.40.974437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:22 UTC594OUTGET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1
                                                                                          Host: clients2.googleusercontent.com
                                                                                          Connection: keep-alive
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:22 UTC572INHTTP/1.1 200 OK
                                                                                          Accept-Ranges: bytes
                                                                                          Content-Length: 135751
                                                                                          X-GUploader-UploadID: AHxI1nPKFDd5kqna82w8-ep2kkubM4O9YGtH0e72ljwJN2YjhFF-d56rgoO3K24RqRDO0fFlOjeu9g6vuA
                                                                                          X-Goog-Hash: crc32c=IDdmTg==
                                                                                          Server: UploadServer
                                                                                          Date: Sun, 25 Aug 2024 15:56:45 GMT
                                                                                          Expires: Mon, 25 Aug 2025 15:56:45 GMT
                                                                                          Cache-Control: public, max-age=31536000
                                                                                          Age: 4537
                                                                                          Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT
                                                                                          ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016
                                                                                          Content-Type: application/x-chrome-extension
                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                          Connection: close
                                                                                          2024-08-25 17:12:22 UTC818INData Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08
                                                                                          Data Ascii: Cr240"0*H0^1"wgt2JG1)X4=&?[j,Lzjue[Iq*Ba/XPhL2%3_oH)'=e?j3UH|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9
                                                                                          Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.|ws+LT>&&Pjanss9ga:SY>
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba
                                                                                          Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z|pQ"k<`ZT|uKC1Yg4ewW
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14
                                                                                          Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b|wt7nvtD<C}|7e^m?<F\p2uB<Yx9"AI3\[s5y~
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67
                                                                                          Data Ascii: wgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:g
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54
                                                                                          Data Ascii: h3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d
                                                                                          Data Ascii: ,ef4=%2n$hgffa,_@uYk|9.Y1+x8aBP|*].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=e*ZkLS65mj}0"$M
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83
                                                                                          Data Ascii: bpnh"|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF|V1lvgf&3]1g>Lc(s.u
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d
                                                                                          Data Ascii: "P|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=
                                                                                          2024-08-25 17:12:22 UTC1390INData Raw: 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf
                                                                                          Data Ascii: W`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          13192.168.2.449786152.195.19.974437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:24 UTC614OUTGET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725210726&P2=404&P3=2&P4=O77p0UKOKArWtpGMuwvQZVcIk%2fk1DA7Ji59HimrrcvrA145rkHawl4xLUZLKsyR8JOxnnZQNbjqnKgYFdt8OTw%3d%3d HTTP/1.1
                                                                                          Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                                                          Connection: keep-alive
                                                                                          MS-CV: Ck6usvdY9iORV35Ia1offt
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:24 UTC632INHTTP/1.1 200 OK
                                                                                          Accept-Ranges: bytes
                                                                                          Age: 4532475
                                                                                          Cache-Control: public, max-age=17280000
                                                                                          Content-Type: application/x-chrome-extension
                                                                                          Date: Sun, 25 Aug 2024 17:12:24 GMT
                                                                                          Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8="
                                                                                          Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT
                                                                                          MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31
                                                                                          MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0
                                                                                          MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4
                                                                                          Server: ECAcc (nyd/D11E)
                                                                                          X-AspNet-Version: 4.0.30319
                                                                                          X-AspNetMvc-Version: 5.3
                                                                                          X-Cache: HIT
                                                                                          X-CCC: US
                                                                                          X-CID: 11
                                                                                          X-Powered-By: ASP.NET
                                                                                          X-Powered-By: ARR/3.0
                                                                                          X-Powered-By: ASP.NET
                                                                                          Content-Length: 11185
                                                                                          Connection: close
                                                                                          2024-08-25 17:12:24 UTC11185INData Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20
                                                                                          Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          14192.168.2.449787142.251.40.1064437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:24 UTC448OUTPOST /chromewebstore/v1.1/items/verify HTTP/1.1
                                                                                          Host: www.googleapis.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 119
                                                                                          Content-Type: application/json
                                                                                          Sec-Fetch-Site: none
                                                                                          Sec-Fetch-Mode: no-cors
                                                                                          Sec-Fetch-Dest: empty
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:12:24 UTC119OUTData Raw: 7b 22 68 61 73 68 22 3a 22 41 72 61 75 66 67 47 47 2b 4d 6d 36 48 42 4e 49 4c 36 6b 46 59 38 66 54 31 6b 69 47 62 64 63 34 61 5a 6a 4e 35 6a 6b 7a 61 71 49 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d
                                                                                          Data Ascii: {"hash":"AraufgGG+Mm6HBNIL6kFY8fT1kiGbdc4aZjN5jkzaqI=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
                                                                                          2024-08-25 17:12:25 UTC341INHTTP/1.1 200 OK
                                                                                          Content-Type: application/json; charset=UTF-8
                                                                                          Vary: Origin
                                                                                          Vary: X-Origin
                                                                                          Vary: Referer
                                                                                          Date: Sun, 25 Aug 2024 17:12:25 GMT
                                                                                          Server: ESF
                                                                                          Content-Length: 483
                                                                                          X-XSS-Protection: 0
                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                          X-Content-Type-Options: nosniff
                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                          Connection: close
                                                                                          2024-08-25 17:12:25 UTC483INData Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 53 6e 44 4f 74 2b 48 47 57 34 31 34 70 72 4f 61 55 38 65 32 39 54 6f 47 39 50 61 75 79 78 31 6f 76 69 75 58 4e 43 53 35 74 6f 61 67 38 36 39 35 47 48 79 44 76 6a 6c 6c 5a 6f 75 34 55 31 38 37 4d 4a 77 36 2f 34 62 4f 7a 34 77 4e 78 58 53 67 4a 35 31 54 61 4f 38 71 77 72 71 74 43 51 53 74 64 73 54 53 5a 7a 38 2f 4a 79 35 37 54 42 4f 33 57 42 73 78 31 39 36 42 53 75 7a 4d 48 79 54 61 54 31 5a 31 79 5a 6b 48 48 36 79 37 35 78 39 55 35 37 47 5a 57 63 7a 48 33 67 50 62 74 66 37 4d 2b 31 50 57 2b 33 43 48 75 4a 68 52 7a 4e 66 6a 43 32 63 41 49 71 31 70 65 66 47 7a 48 4b 4c 52 6e 5a 74 36 41 71 58 2f 5a 49 34 4c 6e 2f 39 37 58 48 4a 4c
                                                                                          Data Ascii: { "protocol_version": 1, "signature": "SnDOt+HGW414prOaU8e29ToG9Pauyx1oviuXNCS5toag8695GHyDvjllZou4U187MJw6/4bOz4wNxXSgJ51TaO8qwrqtCQStdsTSZz8/Jy57TBO3WBsx196BSuzMHyTaT1Z1yZkHH6y75x9U57GZWczH3gPbtf7M+1PW+3CHuJhRzNfjC2cAIq1pefGzHKLRnZt6AqX/ZI4Ln/97XHJL


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          15192.168.2.449788162.159.61.34437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:25 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                          Host: chrome.cloudflare-dns.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 128
                                                                                          Accept: application/dns-message
                                                                                          Accept-Language: *
                                                                                          User-Agent: Chrome
                                                                                          Accept-Encoding: identity
                                                                                          Content-Type: application/dns-message
                                                                                          2024-08-25 17:12:25 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: edgemicrosoftcom)QM
                                                                                          2024-08-25 17:12:25 UTC247INHTTP/1.1 200 OK
                                                                                          Server: cloudflare
                                                                                          Date: Sun, 25 Aug 2024 17:12:25 GMT
                                                                                          Content-Type: application/dns-message
                                                                                          Connection: close
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Content-Length: 468
                                                                                          CF-RAY: 8b8d34f75e9bc34e-EWR
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          2024-08-25 17:12:25 UTC468INData Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d f7 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 23 00 02 c0 43 c0 43 00 01 00 01 00 00 00 23 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 23 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0#CC#OC#k)>:


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          16192.168.2.449789162.159.61.34437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:25 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                          Host: chrome.cloudflare-dns.com
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 128
                                                                                          Accept: application/dns-message
                                                                                          Accept-Language: *
                                                                                          User-Agent: Chrome
                                                                                          Accept-Encoding: identity
                                                                                          Content-Type: application/dns-message
                                                                                          2024-08-25 17:12:25 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: edgemicrosoftcomA)QM
                                                                                          2024-08-25 17:12:25 UTC247INHTTP/1.1 200 OK
                                                                                          Server: cloudflare
                                                                                          Date: Sun, 25 Aug 2024 17:12:25 GMT
                                                                                          Content-Type: application/dns-message
                                                                                          Connection: close
                                                                                          Access-Control-Allow-Origin: *
                                                                                          Content-Length: 468
                                                                                          CF-RAY: 8b8d34f769427c69-EWR
                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                          2024-08-25 17:12:25 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 81 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 61 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                          Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetOa#ns1Omsnhstx+"$)=9


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          17192.168.2.44980320.114.59.183443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:12:55 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vDoZ+7e+4bO81aT&MD=hDGSuHOy HTTP/1.1
                                                                                          Connection: Keep-Alive
                                                                                          Accept: */*
                                                                                          User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                                                          Host: slscr.update.microsoft.com
                                                                                          2024-08-25 17:12:55 UTC560INHTTP/1.1 200 OK
                                                                                          Cache-Control: no-cache
                                                                                          Pragma: no-cache
                                                                                          Content-Type: application/octet-stream
                                                                                          Expires: -1
                                                                                          Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                                                          ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                                                          MS-CorrelationId: 4c27a2ba-df94-4087-88fc-cc2558a81706
                                                                                          MS-RequestId: 269bec47-e6f9-4b2d-a637-d18d90ce2587
                                                                                          MS-CV: XtfiCwrw20uGUMQt.0
                                                                                          X-Microsoft-SLSClientCache: 1440
                                                                                          Content-Disposition: attachment; filename=environment.cab
                                                                                          X-Content-Type-Options: nosniff
                                                                                          Date: Sun, 25 Aug 2024 17:12:55 GMT
                                                                                          Connection: close
                                                                                          Content-Length: 30005
                                                                                          2024-08-25 17:12:55 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                                                          Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                                                          2024-08-25 17:12:55 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                                                          Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          18192.168.2.44980823.44.133.574437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:13:06 UTC442OUTOPTIONS /api/report?cat=bingbusiness HTTP/1.1
                                                                                          Host: bzib.nelreports.net
                                                                                          Connection: keep-alive
                                                                                          Origin: https://business.bing.com
                                                                                          Access-Control-Request-Method: POST
                                                                                          Access-Control-Request-Headers: content-type
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:13:06 UTC360INHTTP/1.1 200 OK
                                                                                          Content-Length: 0
                                                                                          Access-Control-Allow-Headers: content-type
                                                                                          Date: Sun, 25 Aug 2024 17:13:06 GMT
                                                                                          Connection: close
                                                                                          PMUSER_FORMAT_QS:
                                                                                          X-CDN-TraceId: 0.39862c17.1724605986.ee5b595
                                                                                          Access-Control-Allow-Credentials: false
                                                                                          Access-Control-Allow-Methods: *
                                                                                          Access-Control-Allow-Methods: GET, OPTIONS, POST
                                                                                          Access-Control-Allow-Origin: *


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          19192.168.2.44980923.44.133.574437672C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-08-25 17:13:06 UTC382OUTPOST /api/report?cat=bingbusiness HTTP/1.1
                                                                                          Host: bzib.nelreports.net
                                                                                          Connection: keep-alive
                                                                                          Content-Length: 465
                                                                                          Content-Type: application/reports+json
                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                          Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                          2024-08-25 17:13:06 UTC465OUTData Raw: 5b 7b 22 61 67 65 22 3a 36 30 30 30 38 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 30 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67
                                                                                          Data Ascii: [{"age":60008,"body":{"elapsed_time":904,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing
                                                                                          2024-08-25 17:13:07 UTC358INHTTP/1.1 200 OK
                                                                                          Content-Length: 21
                                                                                          Content-Type: text/plain; charset=utf-8
                                                                                          Date: Sun, 25 Aug 2024 17:13:06 GMT
                                                                                          Connection: close
                                                                                          PMUSER_FORMAT_QS:
                                                                                          X-CDN-TraceId: 0.39862c17.1724605986.ee5b754
                                                                                          Access-Control-Allow-Credentials: false
                                                                                          Access-Control-Allow-Methods: *
                                                                                          Access-Control-Allow-Methods: GET, OPTIONS, POST
                                                                                          Access-Control-Allow-Origin: *
                                                                                          2024-08-25 17:13:07 UTC21INData Raw: 50 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74
                                                                                          Data Ascii: Processed the request


                                                                                          Statistics

                                                                                          CPU Usage

                                                                                          Click to jump to process

                                                                                          Memory Usage

                                                                                          Click to jump to process

                                                                                          High Level Behavior Distribution

                                                                                          Click to dive into process behavior distribution

                                                                                          Behavior

                                                                                          Click to jump to process

                                                                                          System Behavior

                                                                                          General

                                                                                          Target ID:0
                                                                                          Start time:13:11:57
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Users\user\Desktop\file.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                          Imagebase:0xd60000
                                                                                          File size:917'504 bytes
                                                                                          MD5 hash:26E9A7949CC17782F6595EA8CC61CC51
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:1
                                                                                          Start time:13:11:58
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:2
                                                                                          Start time:13:11:58
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                          Imagebase:0x7ff6bf500000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:3
                                                                                          Start time:13:11:58
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
                                                                                          Imagebase:0x7ff6bf500000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:4
                                                                                          Start time:13:11:59
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                          Imagebase:0x7ff6bf500000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:6
                                                                                          Start time:13:11:59
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2076,i,9262140819210308116,14005196372618419780,262144 /prefetch:3
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:7
                                                                                          Start time:13:11:59
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:8
                                                                                          Start time:13:12:01
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2884 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:3
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:10
                                                                                          Start time:13:12:04
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7a9f113-9e6d-45ad-ab60-94915a598ad8} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28243d6e510 socket
                                                                                          Imagebase:0x7ff6bf500000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:12
                                                                                          Start time:13:12:05
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6588 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:13
                                                                                          Start time:13:12:05
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6752 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:14
                                                                                          Start time:13:12:07
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
                                                                                          Imagebase:0x7ff63a760000
                                                                                          File size:1'255'976 bytes
                                                                                          MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:15
                                                                                          Start time:13:12:07
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7008 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
                                                                                          Imagebase:0x7ff63a760000
                                                                                          File size:1'255'976 bytes
                                                                                          MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:16
                                                                                          Start time:13:12:08
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2966af3d-95c8-4906-bee5-aa169991a07c} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 28255bf0110 rdd
                                                                                          Imagebase:0x7ff6bf500000
                                                                                          File size:676'768 bytes
                                                                                          MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:18
                                                                                          Start time:13:12:17
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:19
                                                                                          Start time:13:12:18
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2032,i,14870212226961383276,9342203305708835618,262144 /prefetch:3
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:22
                                                                                          Start time:13:12:25
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:23
                                                                                          Start time:13:12:26
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2052,i,4253546098503553412,11041898619462647217,262144 /prefetch:3
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:25
                                                                                          Start time:13:13:01
                                                                                          Start date:25/08/2024
                                                                                          Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6684 --field-trial-handle=2128,i,2206578964468491155,15584789532163154380,262144 /prefetch:8
                                                                                          Imagebase:0x7ff67dcd0000
                                                                                          File size:4'210'216 bytes
                                                                                          MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:false

                                                                                          Disassembly

                                                                                          Reset < >

                                                                                            Execution Graph

                                                                                            Execution Coverage:1.8%
                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                            Signature Coverage:7.6%
                                                                                            Total number of Nodes:1389
                                                                                            Total number of Limit Nodes:38
                                                                                            execution_graph 95079 d63156 95082 d63170 95079->95082 95083 d63187 95082->95083 95084 d6318c 95083->95084 95085 d631eb 95083->95085 95121 d631e9 95083->95121 95089 d63265 PostQuitMessage 95084->95089 95090 d63199 95084->95090 95087 da2dfb 95085->95087 95088 d631f1 95085->95088 95086 d631d0 DefWindowProcW 95124 d6316a 95086->95124 95134 d618e2 10 API calls 95087->95134 95091 d6321d SetTimer RegisterWindowMessageW 95088->95091 95092 d631f8 95088->95092 95089->95124 95094 d631a4 95090->95094 95095 da2e7c 95090->95095 95099 d63246 CreatePopupMenu 95091->95099 95091->95124 95096 da2d9c 95092->95096 95097 d63201 KillTimer 95092->95097 95100 da2e68 95094->95100 95101 d631ae 95094->95101 95148 dcbf30 34 API calls ___scrt_fastfail 95095->95148 95103 da2da1 95096->95103 95104 da2dd7 MoveWindow 95096->95104 95127 d630f2 95097->95127 95098 da2e1c 95135 d7e499 42 API calls 95098->95135 95099->95124 95147 dcc161 27 API calls ___scrt_fastfail 95100->95147 95108 da2e4d 95101->95108 95109 d631b9 95101->95109 95111 da2dc6 SetFocus 95103->95111 95112 da2da7 95103->95112 95104->95124 95108->95086 95146 dc0ad7 22 API calls 95108->95146 95114 d63253 95109->95114 95119 d631c4 95109->95119 95110 da2e8e 95110->95086 95110->95124 95111->95124 95115 da2db0 95112->95115 95112->95119 95132 d6326f 44 API calls ___scrt_fastfail 95114->95132 95133 d618e2 10 API calls 95115->95133 95119->95086 95123 d630f2 Shell_NotifyIconW 95119->95123 95121->95086 95122 d63263 95122->95124 95125 da2e41 95123->95125 95136 d63837 95125->95136 95128 d63154 95127->95128 95129 d63104 ___scrt_fastfail 95127->95129 95131 d63c50 DeleteObject DestroyWindow 95128->95131 95130 d63123 Shell_NotifyIconW 95129->95130 95130->95128 95131->95124 95132->95122 95133->95124 95134->95098 95135->95119 95137 d63862 ___scrt_fastfail 95136->95137 95149 d64212 95137->95149 95140 d638e8 95142 d63906 Shell_NotifyIconW 95140->95142 95143 da3386 Shell_NotifyIconW 95140->95143 95153 d63923 95142->95153 95145 d6391c 95145->95121 95146->95121 95147->95122 95148->95110 95150 d638b7 95149->95150 95151 da35a4 95149->95151 95150->95140 95175 dcc874 42 API calls _strftime 95150->95175 95151->95150 95152 da35ad DestroyIcon 95151->95152 95152->95150 95154 d6393f 95153->95154 95173 d63a13 95153->95173 95176 d66270 95154->95176 95157 da3393 LoadStringW 95160 da33ad 95157->95160 95158 d6395a 95181 d66b57 95158->95181 95168 d63994 ___scrt_fastfail 95160->95168 95194 d6a8c7 22 API calls __fread_nolock 95160->95194 95161 d6396f 95162 da33c9 95161->95162 95163 d6397c 95161->95163 95195 d66350 22 API calls 95162->95195 95163->95160 95165 d63986 95163->95165 95193 d66350 22 API calls 95165->95193 95170 d639f9 Shell_NotifyIconW 95168->95170 95169 da33d7 95169->95168 95196 d633c6 95169->95196 95170->95173 95172 da33f9 95174 d633c6 22 API calls 95172->95174 95173->95145 95174->95168 95175->95140 95205 d7fe0b 95176->95205 95178 d66295 95215 d7fddb 95178->95215 95180 d6394d 95180->95157 95180->95158 95182 da4ba1 95181->95182 95183 d66b67 _wcslen 95181->95183 95241 d693b2 95182->95241 95186 d66ba2 95183->95186 95187 d66b7d 95183->95187 95185 da4baa 95185->95185 95189 d7fddb 22 API calls 95186->95189 95240 d66f34 22 API calls 95187->95240 95191 d66bae 95189->95191 95190 d66b85 __fread_nolock 95190->95161 95192 d7fe0b 22 API calls 95191->95192 95192->95190 95193->95168 95194->95168 95195->95169 95197 da30bb 95196->95197 95198 d633dd 95196->95198 95200 d7fddb 22 API calls 95197->95200 95251 d633ee 95198->95251 95202 da30c5 _wcslen 95200->95202 95201 d633e8 95201->95172 95203 d7fe0b 22 API calls 95202->95203 95204 da30fe __fread_nolock 95203->95204 95207 d7fddb 95205->95207 95208 d7fdfa 95207->95208 95212 d7fdfc 95207->95212 95225 d8ea0c 95207->95225 95232 d84ead 7 API calls 2 library calls 95207->95232 95208->95178 95210 d8066d 95234 d832a4 RaiseException 95210->95234 95212->95210 95233 d832a4 RaiseException 95212->95233 95214 d8068a 95214->95178 95217 d7fde0 95215->95217 95216 d8ea0c ___std_exception_copy 21 API calls 95216->95217 95217->95216 95218 d7fdfa 95217->95218 95222 d7fdfc 95217->95222 95237 d84ead 7 API calls 2 library calls 95217->95237 95218->95180 95220 d8066d 95239 d832a4 RaiseException 95220->95239 95222->95220 95238 d832a4 RaiseException 95222->95238 95224 d8068a 95224->95180 95230 d93820 __dosmaperr 95225->95230 95226 d9385e 95236 d8f2d9 20 API calls __dosmaperr 95226->95236 95228 d93849 RtlAllocateHeap 95229 d9385c 95228->95229 95228->95230 95229->95207 95230->95226 95230->95228 95235 d84ead 7 API calls 2 library calls 95230->95235 95232->95207 95233->95210 95234->95214 95235->95230 95236->95229 95237->95217 95238->95220 95239->95224 95240->95190 95242 d693c0 95241->95242 95244 d693c9 __fread_nolock 95241->95244 95242->95244 95245 d6aec9 95242->95245 95244->95185 95246 d6aedc 95245->95246 95247 d6aed9 __fread_nolock 95245->95247 95248 d7fddb 22 API calls 95246->95248 95247->95244 95249 d6aee7 95248->95249 95250 d7fe0b 22 API calls 95249->95250 95250->95247 95252 d633fe _wcslen 95251->95252 95253 da311d 95252->95253 95254 d63411 95252->95254 95256 d7fddb 22 API calls 95253->95256 95261 d6a587 95254->95261 95258 da3127 95256->95258 95257 d6341e __fread_nolock 95257->95201 95259 d7fe0b 22 API calls 95258->95259 95260 da3157 __fread_nolock 95259->95260 95262 d6a59d 95261->95262 95265 d6a598 __fread_nolock 95261->95265 95263 daf80f 95262->95263 95264 d7fe0b 22 API calls 95262->95264 95264->95265 95265->95257 95266 d62e37 95345 d6a961 95266->95345 95270 d62e6b 95364 d63a5a 95270->95364 95272 d62e7f 95371 d69cb3 95272->95371 95277 da2cb0 95417 dd2cf9 95277->95417 95278 d62ead 95399 d6a8c7 22 API calls __fread_nolock 95278->95399 95280 da2cc3 95281 da2ccf 95280->95281 95443 d64f39 95280->95443 95286 d64f39 68 API calls 95281->95286 95284 d62ec3 95400 d66f88 22 API calls 95284->95400 95288 da2ce5 95286->95288 95287 d62ecf 95289 d69cb3 22 API calls 95287->95289 95449 d63084 22 API calls 95288->95449 95290 d62edc 95289->95290 95401 d6a81b 41 API calls 95290->95401 95292 d62eec 95295 d69cb3 22 API calls 95292->95295 95294 da2d02 95450 d63084 22 API calls 95294->95450 95297 d62f12 95295->95297 95402 d6a81b 41 API calls 95297->95402 95298 da2d1e 95300 d63a5a 24 API calls 95298->95300 95301 da2d44 95300->95301 95451 d63084 22 API calls 95301->95451 95302 d62f21 95305 d6a961 22 API calls 95302->95305 95304 da2d50 95452 d6a8c7 22 API calls __fread_nolock 95304->95452 95307 d62f3f 95305->95307 95403 d63084 22 API calls 95307->95403 95308 da2d5e 95453 d63084 22 API calls 95308->95453 95310 d62f4b 95404 d84a28 40 API calls 3 library calls 95310->95404 95313 da2d6d 95454 d6a8c7 22 API calls __fread_nolock 95313->95454 95314 d62f59 95314->95288 95315 d62f63 95314->95315 95405 d84a28 40 API calls 3 library calls 95315->95405 95318 da2d83 95455 d63084 22 API calls 95318->95455 95319 d62f6e 95319->95294 95321 d62f78 95319->95321 95406 d84a28 40 API calls 3 library calls 95321->95406 95322 da2d90 95324 d62f83 95324->95298 95325 d62f8d 95324->95325 95407 d84a28 40 API calls 3 library calls 95325->95407 95327 d62f98 95328 d62fdc 95327->95328 95408 d63084 22 API calls 95327->95408 95328->95313 95329 d62fe8 95328->95329 95329->95322 95411 d663eb 22 API calls 95329->95411 95331 d62fbf 95409 d6a8c7 22 API calls __fread_nolock 95331->95409 95334 d62ff8 95412 d66a50 22 API calls 95334->95412 95335 d62fcd 95410 d63084 22 API calls 95335->95410 95338 d63006 95413 d670b0 23 API calls 95338->95413 95342 d63021 95343 d63065 95342->95343 95414 d66f88 22 API calls 95342->95414 95415 d670b0 23 API calls 95342->95415 95416 d63084 22 API calls 95342->95416 95346 d7fe0b 22 API calls 95345->95346 95347 d6a976 95346->95347 95348 d7fddb 22 API calls 95347->95348 95349 d62e4d 95348->95349 95350 d64ae3 95349->95350 95351 d64af0 __wsopen_s 95350->95351 95352 d66b57 22 API calls 95351->95352 95353 d64b22 95351->95353 95352->95353 95362 d64b58 95353->95362 95456 d64c6d 95353->95456 95355 d69cb3 22 API calls 95357 d64c52 95355->95357 95356 d69cb3 22 API calls 95356->95362 95358 d6515f 22 API calls 95357->95358 95361 d64c5e 95358->95361 95359 d64c6d 22 API calls 95359->95362 95361->95270 95362->95356 95362->95359 95363 d64c29 95362->95363 95459 d6515f 95362->95459 95363->95355 95363->95361 95465 da1f50 95364->95465 95367 d69cb3 22 API calls 95368 d63a8d 95367->95368 95467 d63aa2 95368->95467 95370 d63a97 95370->95272 95372 d69cc2 _wcslen 95371->95372 95373 d7fe0b 22 API calls 95372->95373 95374 d69cea __fread_nolock 95373->95374 95375 d7fddb 22 API calls 95374->95375 95376 d62e8c 95375->95376 95377 d64ecb 95376->95377 95487 d64e90 LoadLibraryA 95377->95487 95382 d64ef6 LoadLibraryExW 95495 d64e59 LoadLibraryA 95382->95495 95383 da3ccf 95384 d64f39 68 API calls 95383->95384 95387 da3cd6 95384->95387 95389 d64e59 3 API calls 95387->95389 95391 da3cde 95389->95391 95390 d64f20 95390->95391 95392 d64f2c 95390->95392 95517 d650f5 40 API calls __fread_nolock 95391->95517 95393 d64f39 68 API calls 95392->95393 95395 d62ea5 95393->95395 95395->95277 95395->95278 95396 da3cf5 95518 dd28fe 27 API calls 95396->95518 95398 da3d05 95399->95284 95400->95287 95401->95292 95402->95302 95403->95310 95404->95314 95405->95319 95406->95324 95407->95327 95408->95331 95409->95335 95410->95328 95411->95334 95412->95338 95413->95342 95414->95342 95415->95342 95416->95342 95418 dd2d15 95417->95418 95601 d6511f 64 API calls 95418->95601 95420 dd2d29 95602 dd2e66 75 API calls 95420->95602 95422 dd2d3b 95423 dd2d3f 95422->95423 95603 d650f5 40 API calls __fread_nolock 95422->95603 95423->95280 95425 dd2d56 95604 d650f5 40 API calls __fread_nolock 95425->95604 95427 dd2d66 95605 d650f5 40 API calls __fread_nolock 95427->95605 95429 dd2d81 95606 d650f5 40 API calls __fread_nolock 95429->95606 95431 dd2d9c 95607 d6511f 64 API calls 95431->95607 95433 dd2db3 95434 d8ea0c ___std_exception_copy 21 API calls 95433->95434 95435 dd2dba 95434->95435 95436 d8ea0c ___std_exception_copy 21 API calls 95435->95436 95437 dd2dc4 95436->95437 95608 d650f5 40 API calls __fread_nolock 95437->95608 95439 dd2dd8 95609 dd28fe 27 API calls 95439->95609 95441 dd2dee 95441->95423 95610 dd22ce 95441->95610 95444 d64f43 95443->95444 95448 d64f4a 95443->95448 95445 d8e678 67 API calls 95444->95445 95445->95448 95446 d64f6a FreeLibrary 95447 d64f59 95446->95447 95447->95281 95448->95446 95448->95447 95449->95294 95450->95298 95451->95304 95452->95308 95453->95313 95454->95318 95455->95322 95457 d6aec9 22 API calls 95456->95457 95458 d64c78 95457->95458 95458->95353 95460 d6516e 95459->95460 95464 d6518f __fread_nolock 95459->95464 95463 d7fe0b 22 API calls 95460->95463 95461 d7fddb 22 API calls 95462 d651a2 95461->95462 95462->95362 95463->95464 95464->95461 95466 d63a67 GetModuleFileNameW 95465->95466 95466->95367 95468 da1f50 __wsopen_s 95467->95468 95469 d63aaf GetFullPathNameW 95468->95469 95470 d63ace 95469->95470 95471 d63ae9 95469->95471 95473 d66b57 22 API calls 95470->95473 95481 d6a6c3 95471->95481 95474 d63ada 95473->95474 95477 d637a0 95474->95477 95478 d637ae 95477->95478 95479 d693b2 22 API calls 95478->95479 95480 d637c2 95479->95480 95480->95370 95482 d6a6dd 95481->95482 95486 d6a6d0 95481->95486 95483 d7fddb 22 API calls 95482->95483 95484 d6a6e7 95483->95484 95485 d7fe0b 22 API calls 95484->95485 95485->95486 95486->95474 95488 d64ec6 95487->95488 95489 d64ea8 GetProcAddress 95487->95489 95492 d8e5eb 95488->95492 95490 d64eb8 95489->95490 95490->95488 95491 d64ebf FreeLibrary 95490->95491 95491->95488 95519 d8e52a 95492->95519 95494 d64eea 95494->95382 95494->95383 95496 d64e6e GetProcAddress 95495->95496 95497 d64e8d 95495->95497 95498 d64e7e 95496->95498 95500 d64f80 95497->95500 95498->95497 95499 d64e86 FreeLibrary 95498->95499 95499->95497 95501 d7fe0b 22 API calls 95500->95501 95502 d64f95 95501->95502 95587 d65722 95502->95587 95504 d64fa1 __fread_nolock 95505 d650a5 95504->95505 95506 da3d1d 95504->95506 95513 d64fdc 95504->95513 95590 d642a2 CreateStreamOnHGlobal 95505->95590 95598 dd304d 74 API calls 95506->95598 95509 da3d22 95599 d6511f 64 API calls 95509->95599 95512 da3d45 95600 d650f5 40 API calls __fread_nolock 95512->95600 95513->95509 95516 d6506e messages 95513->95516 95596 d650f5 40 API calls __fread_nolock 95513->95596 95597 d6511f 64 API calls 95513->95597 95516->95390 95517->95396 95518->95398 95522 d8e536 __FrameHandler3::FrameUnwindToState 95519->95522 95520 d8e544 95544 d8f2d9 20 API calls __dosmaperr 95520->95544 95522->95520 95524 d8e574 95522->95524 95523 d8e549 95545 d927ec 26 API calls pre_c_initialization 95523->95545 95526 d8e579 95524->95526 95527 d8e586 95524->95527 95546 d8f2d9 20 API calls __dosmaperr 95526->95546 95536 d98061 95527->95536 95530 d8e58f 95531 d8e5a2 95530->95531 95532 d8e595 95530->95532 95548 d8e5d4 LeaveCriticalSection __fread_nolock 95531->95548 95547 d8f2d9 20 API calls __dosmaperr 95532->95547 95533 d8e554 __fread_nolock 95533->95494 95537 d9806d __FrameHandler3::FrameUnwindToState 95536->95537 95549 d92f5e EnterCriticalSection 95537->95549 95539 d9807b 95550 d980fb 95539->95550 95543 d980ac __fread_nolock 95543->95530 95544->95523 95545->95533 95546->95533 95547->95533 95548->95533 95549->95539 95557 d9811e 95550->95557 95551 d98088 95563 d980b7 95551->95563 95552 d98177 95568 d94c7d 95552->95568 95557->95551 95557->95552 95566 d8918d EnterCriticalSection 95557->95566 95567 d891a1 LeaveCriticalSection 95557->95567 95558 d98189 95558->95551 95581 d93405 11 API calls 2 library calls 95558->95581 95560 d981a8 95582 d8918d EnterCriticalSection 95560->95582 95586 d92fa6 LeaveCriticalSection 95563->95586 95565 d980be 95565->95543 95566->95557 95567->95557 95573 d94c8a __dosmaperr 95568->95573 95569 d94cca 95584 d8f2d9 20 API calls __dosmaperr 95569->95584 95570 d94cb5 RtlAllocateHeap 95572 d94cc8 95570->95572 95570->95573 95575 d929c8 95572->95575 95573->95569 95573->95570 95583 d84ead 7 API calls 2 library calls 95573->95583 95576 d929fc _free 95575->95576 95577 d929d3 RtlFreeHeap 95575->95577 95576->95558 95577->95576 95578 d929e8 95577->95578 95585 d8f2d9 20 API calls __dosmaperr 95578->95585 95580 d929ee GetLastError 95580->95576 95581->95560 95582->95551 95583->95573 95584->95572 95585->95580 95586->95565 95588 d7fddb 22 API calls 95587->95588 95589 d65734 95588->95589 95589->95504 95591 d642bc FindResourceExW 95590->95591 95593 d642d9 95590->95593 95592 da35ba LoadResource 95591->95592 95591->95593 95592->95593 95594 da35cf SizeofResource 95592->95594 95593->95513 95594->95593 95595 da35e3 LockResource 95594->95595 95595->95593 95596->95513 95597->95513 95598->95509 95599->95512 95600->95516 95601->95420 95602->95422 95603->95425 95604->95427 95605->95429 95606->95431 95607->95433 95608->95439 95609->95441 95611 dd22d9 95610->95611 95612 dd22e7 95610->95612 95613 d8e5eb 29 API calls 95611->95613 95614 dd232c 95612->95614 95615 d8e5eb 29 API calls 95612->95615 95627 dd22f0 95612->95627 95613->95612 95639 dd2557 40 API calls __fread_nolock 95614->95639 95617 dd2311 95615->95617 95617->95614 95619 dd231a 95617->95619 95618 dd2370 95620 dd2395 95618->95620 95621 dd2374 95618->95621 95619->95627 95647 d8e678 95619->95647 95640 dd2171 95620->95640 95622 dd2381 95621->95622 95626 d8e678 67 API calls 95621->95626 95622->95627 95630 d8e678 67 API calls 95622->95630 95625 dd239d 95628 dd23c3 95625->95628 95629 dd23a3 95625->95629 95626->95622 95627->95423 95660 dd23f3 74 API calls 95628->95660 95631 dd23b0 95629->95631 95633 d8e678 67 API calls 95629->95633 95630->95627 95631->95627 95634 d8e678 67 API calls 95631->95634 95633->95631 95634->95627 95635 dd23ca 95636 dd23de 95635->95636 95637 d8e678 67 API calls 95635->95637 95636->95627 95638 d8e678 67 API calls 95636->95638 95637->95636 95638->95627 95639->95618 95641 d8ea0c ___std_exception_copy 21 API calls 95640->95641 95642 dd217f 95641->95642 95643 d8ea0c ___std_exception_copy 21 API calls 95642->95643 95644 dd2190 95643->95644 95645 d8ea0c ___std_exception_copy 21 API calls 95644->95645 95646 dd219c 95645->95646 95646->95625 95648 d8e684 __FrameHandler3::FrameUnwindToState 95647->95648 95649 d8e6aa 95648->95649 95650 d8e695 95648->95650 95659 d8e6a5 __fread_nolock 95649->95659 95661 d8918d EnterCriticalSection 95649->95661 95678 d8f2d9 20 API calls __dosmaperr 95650->95678 95653 d8e69a 95679 d927ec 26 API calls pre_c_initialization 95653->95679 95654 d8e6c6 95662 d8e602 95654->95662 95657 d8e6d1 95680 d8e6ee LeaveCriticalSection __fread_nolock 95657->95680 95659->95627 95660->95635 95661->95654 95663 d8e60f 95662->95663 95664 d8e624 95662->95664 95713 d8f2d9 20 API calls __dosmaperr 95663->95713 95670 d8e61f 95664->95670 95681 d8dc0b 95664->95681 95667 d8e614 95714 d927ec 26 API calls pre_c_initialization 95667->95714 95670->95657 95674 d8e646 95698 d9862f 95674->95698 95677 d929c8 _free 20 API calls 95677->95670 95678->95653 95679->95659 95680->95659 95682 d8dc23 95681->95682 95686 d8dc1f 95681->95686 95683 d8d955 __fread_nolock 26 API calls 95682->95683 95682->95686 95684 d8dc43 95683->95684 95715 d959be 62 API calls 6 library calls 95684->95715 95687 d94d7a 95686->95687 95688 d94d90 95687->95688 95689 d8e640 95687->95689 95688->95689 95690 d929c8 _free 20 API calls 95688->95690 95691 d8d955 95689->95691 95690->95689 95692 d8d961 95691->95692 95693 d8d976 95691->95693 95716 d8f2d9 20 API calls __dosmaperr 95692->95716 95693->95674 95695 d8d966 95717 d927ec 26 API calls pre_c_initialization 95695->95717 95697 d8d971 95697->95674 95699 d9863e 95698->95699 95702 d98653 95698->95702 95721 d8f2c6 20 API calls __dosmaperr 95699->95721 95700 d9868e 95723 d8f2c6 20 API calls __dosmaperr 95700->95723 95702->95700 95706 d9867a 95702->95706 95704 d98643 95722 d8f2d9 20 API calls __dosmaperr 95704->95722 95718 d98607 95706->95718 95707 d98693 95724 d8f2d9 20 API calls __dosmaperr 95707->95724 95710 d8e64c 95710->95670 95710->95677 95711 d9869b 95725 d927ec 26 API calls pre_c_initialization 95711->95725 95713->95667 95714->95670 95715->95686 95716->95695 95717->95697 95726 d98585 95718->95726 95720 d9862b 95720->95710 95721->95704 95722->95710 95723->95707 95724->95711 95725->95710 95727 d98591 __FrameHandler3::FrameUnwindToState 95726->95727 95737 d95147 EnterCriticalSection 95727->95737 95729 d9859f 95730 d985d1 95729->95730 95731 d985c6 95729->95731 95753 d8f2d9 20 API calls __dosmaperr 95730->95753 95738 d986ae 95731->95738 95734 d985cc 95754 d985fb LeaveCriticalSection __wsopen_s 95734->95754 95736 d985ee __fread_nolock 95736->95720 95737->95729 95755 d953c4 95738->95755 95740 d986be 95741 d986c4 95740->95741 95743 d986f6 95740->95743 95745 d953c4 __wsopen_s 26 API calls 95740->95745 95768 d95333 21 API calls 3 library calls 95741->95768 95743->95741 95746 d953c4 __wsopen_s 26 API calls 95743->95746 95744 d9871c 95747 d9873e 95744->95747 95769 d8f2a3 20 API calls 2 library calls 95744->95769 95748 d986ed 95745->95748 95749 d98702 FindCloseChangeNotification 95746->95749 95747->95734 95752 d953c4 __wsopen_s 26 API calls 95748->95752 95749->95741 95750 d9870e GetLastError 95749->95750 95750->95741 95752->95743 95753->95734 95754->95736 95756 d953d1 95755->95756 95757 d953e6 95755->95757 95770 d8f2c6 20 API calls __dosmaperr 95756->95770 95762 d9540b 95757->95762 95772 d8f2c6 20 API calls __dosmaperr 95757->95772 95759 d953d6 95771 d8f2d9 20 API calls __dosmaperr 95759->95771 95762->95740 95763 d95416 95773 d8f2d9 20 API calls __dosmaperr 95763->95773 95765 d953de 95765->95740 95766 d9541e 95774 d927ec 26 API calls pre_c_initialization 95766->95774 95768->95744 95769->95747 95770->95759 95771->95765 95772->95763 95773->95766 95774->95765 95775 d803fb 95776 d80407 __FrameHandler3::FrameUnwindToState 95775->95776 95804 d7feb1 95776->95804 95778 d8040e 95779 d80561 95778->95779 95782 d80438 95778->95782 95834 d8083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 95779->95834 95781 d80568 95827 d84e52 95781->95827 95793 d80477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 95782->95793 95815 d9247d 95782->95815 95789 d80457 95791 d804d8 95823 d80959 95791->95823 95793->95791 95830 d84e1a 38 API calls 3 library calls 95793->95830 95795 d804de 95796 d804f3 95795->95796 95831 d80992 GetModuleHandleW 95796->95831 95798 d804fa 95798->95781 95799 d804fe 95798->95799 95800 d80507 95799->95800 95832 d84df5 28 API calls _abort 95799->95832 95833 d80040 13 API calls 2 library calls 95800->95833 95803 d8050f 95803->95789 95805 d7feba 95804->95805 95836 d80698 IsProcessorFeaturePresent 95805->95836 95807 d7fec6 95837 d82c94 10 API calls 3 library calls 95807->95837 95809 d7fecb 95810 d7fecf 95809->95810 95838 d92317 95809->95838 95810->95778 95813 d7fee6 95813->95778 95816 d92494 95815->95816 95817 d80a8c CatchGuardHandler 5 API calls 95816->95817 95818 d80451 95817->95818 95818->95789 95819 d92421 95818->95819 95820 d92450 95819->95820 95821 d80a8c CatchGuardHandler 5 API calls 95820->95821 95822 d92479 95821->95822 95822->95793 95897 d82340 95823->95897 95826 d8097f 95826->95795 95899 d84bcf 95827->95899 95830->95791 95831->95798 95832->95800 95833->95803 95834->95781 95836->95807 95837->95809 95842 d9d1f6 95838->95842 95841 d82cbd 8 API calls 3 library calls 95841->95810 95843 d9d213 95842->95843 95846 d9d20f 95842->95846 95843->95846 95848 d94bfb 95843->95848 95845 d7fed8 95845->95813 95845->95841 95860 d80a8c 95846->95860 95849 d94c07 __FrameHandler3::FrameUnwindToState 95848->95849 95867 d92f5e EnterCriticalSection 95849->95867 95851 d94c0e 95868 d950af 95851->95868 95853 d94c1d 95854 d94c2c 95853->95854 95881 d94a8f 29 API calls 95853->95881 95883 d94c48 LeaveCriticalSection _abort 95854->95883 95857 d94c27 95882 d94b45 GetStdHandle GetFileType 95857->95882 95858 d94c3d __fread_nolock 95858->95843 95861 d80a95 95860->95861 95862 d80a97 IsProcessorFeaturePresent 95860->95862 95861->95845 95864 d80c5d 95862->95864 95896 d80c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 95864->95896 95866 d80d40 95866->95845 95867->95851 95869 d950bb __FrameHandler3::FrameUnwindToState 95868->95869 95870 d950c8 95869->95870 95871 d950df 95869->95871 95892 d8f2d9 20 API calls __dosmaperr 95870->95892 95884 d92f5e EnterCriticalSection 95871->95884 95874 d950cd 95893 d927ec 26 API calls pre_c_initialization 95874->95893 95876 d95117 95894 d9513e LeaveCriticalSection _abort 95876->95894 95877 d950d7 __fread_nolock 95877->95853 95878 d950eb 95878->95876 95885 d95000 95878->95885 95881->95857 95882->95854 95883->95858 95884->95878 95886 d94c7d __dosmaperr 20 API calls 95885->95886 95888 d95012 95886->95888 95887 d9501f 95889 d929c8 _free 20 API calls 95887->95889 95888->95887 95895 d93405 11 API calls 2 library calls 95888->95895 95891 d95071 95889->95891 95891->95878 95892->95874 95893->95877 95894->95877 95895->95888 95896->95866 95898 d8096c GetStartupInfoW 95897->95898 95898->95826 95900 d84bdb __FrameHandler3::FrameUnwindToState 95899->95900 95901 d84be2 95900->95901 95902 d84bf4 95900->95902 95938 d84d29 GetModuleHandleW 95901->95938 95923 d92f5e EnterCriticalSection 95902->95923 95905 d84be7 95905->95902 95939 d84d6d GetModuleHandleExW 95905->95939 95908 d84bfb 95920 d84c99 95908->95920 95922 d84c70 95908->95922 95924 d921a8 95908->95924 95911 d84ce2 95947 da1d29 5 API calls CatchGuardHandler 95911->95947 95912 d84cb6 95930 d84ce8 95912->95930 95913 d92421 _abort 5 API calls 95919 d84c88 95913->95919 95914 d92421 _abort 5 API calls 95914->95920 95919->95914 95927 d84cd9 95920->95927 95922->95913 95922->95919 95923->95908 95948 d91ee1 95924->95948 95967 d92fa6 LeaveCriticalSection 95927->95967 95929 d84cb2 95929->95911 95929->95912 95968 d9360c 95930->95968 95933 d84d16 95936 d84d6d _abort 8 API calls 95933->95936 95934 d84cf6 GetPEB 95934->95933 95935 d84d06 GetCurrentProcess TerminateProcess 95934->95935 95935->95933 95937 d84d1e ExitProcess 95936->95937 95938->95905 95940 d84dba 95939->95940 95941 d84d97 GetProcAddress 95939->95941 95943 d84dc9 95940->95943 95944 d84dc0 FreeLibrary 95940->95944 95942 d84dac 95941->95942 95942->95940 95945 d80a8c CatchGuardHandler 5 API calls 95943->95945 95944->95943 95946 d84bf3 95945->95946 95946->95902 95951 d91e90 95948->95951 95950 d91f05 95950->95922 95952 d91e9c __FrameHandler3::FrameUnwindToState 95951->95952 95959 d92f5e EnterCriticalSection 95952->95959 95954 d91eaa 95960 d91f31 95954->95960 95958 d91ec8 __fread_nolock 95958->95950 95959->95954 95963 d91f59 95960->95963 95965 d91f51 95960->95965 95961 d80a8c CatchGuardHandler 5 API calls 95962 d91eb7 95961->95962 95966 d91ed5 LeaveCriticalSection _abort 95962->95966 95964 d929c8 _free 20 API calls 95963->95964 95963->95965 95964->95965 95965->95961 95966->95958 95967->95929 95969 d93631 95968->95969 95970 d93627 95968->95970 95975 d92fd7 5 API calls 2 library calls 95969->95975 95972 d80a8c CatchGuardHandler 5 API calls 95970->95972 95973 d84cf2 95972->95973 95973->95933 95973->95934 95974 d93648 95974->95970 95975->95974 95976 d61033 95981 d64c91 95976->95981 95980 d61042 95982 d6a961 22 API calls 95981->95982 95983 d64cff 95982->95983 95989 d63af0 95983->95989 95986 d64d9c 95987 d61038 95986->95987 95992 d651f7 22 API calls __fread_nolock 95986->95992 95988 d800a3 29 API calls __onexit 95987->95988 95988->95980 95993 d63b1c 95989->95993 95992->95986 95994 d63b0f 95993->95994 95995 d63b29 95993->95995 95994->95986 95995->95994 95996 d63b30 RegOpenKeyExW 95995->95996 95996->95994 95997 d63b4a RegQueryValueExW 95996->95997 95998 d63b80 RegCloseKey 95997->95998 95999 d63b6b 95997->95999 95998->95994 95999->95998 96000 d6f7bf 96001 d6fcb6 96000->96001 96002 d6f7d3 96000->96002 96088 d6aceb 23 API calls messages 96001->96088 96004 d6fcc2 96002->96004 96005 d7fddb 22 API calls 96002->96005 96089 d6aceb 23 API calls messages 96004->96089 96007 d6f7e5 96005->96007 96007->96004 96008 d6f83e 96007->96008 96009 d6fd3d 96007->96009 96032 d6ed9d messages 96008->96032 96035 d71310 96008->96035 96090 dd1155 22 API calls 96009->96090 96012 d6fef7 96012->96032 96092 d6a8c7 22 API calls __fread_nolock 96012->96092 96015 d7fddb 22 API calls 96031 d6ec76 messages 96015->96031 96016 db4600 96016->96032 96091 d6a8c7 22 API calls __fread_nolock 96016->96091 96017 db4b0b 96094 dd359c 82 API calls __wsopen_s 96017->96094 96023 d6a8c7 22 API calls 96023->96031 96024 d6fbe3 96026 db4bdc 96024->96026 96024->96032 96034 d6f3ae messages 96024->96034 96025 d6a961 22 API calls 96025->96031 96095 dd359c 82 API calls __wsopen_s 96026->96095 96028 d800a3 29 API calls pre_c_initialization 96028->96031 96029 d80242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96029->96031 96030 db4beb 96096 dd359c 82 API calls __wsopen_s 96030->96096 96031->96012 96031->96015 96031->96016 96031->96017 96031->96023 96031->96024 96031->96025 96031->96028 96031->96029 96031->96030 96031->96032 96033 d801f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96031->96033 96031->96034 96086 d701e0 185 API calls 2 library calls 96031->96086 96087 d706a0 41 API calls messages 96031->96087 96033->96031 96034->96032 96093 dd359c 82 API calls __wsopen_s 96034->96093 96036 d71376 96035->96036 96037 d717b0 96035->96037 96038 db6331 96036->96038 96040 d71940 9 API calls 96036->96040 96145 d80242 5 API calls __Init_thread_wait 96037->96145 96150 de709c 185 API calls 96038->96150 96043 d713a0 96040->96043 96042 d717ba 96046 d69cb3 22 API calls 96042->96046 96048 d717fb 96042->96048 96045 d71940 9 API calls 96043->96045 96044 db633d 96044->96031 96047 d713b6 96045->96047 96052 d717d4 96046->96052 96047->96048 96049 d713ec 96047->96049 96050 db6346 96048->96050 96051 d7182c 96048->96051 96049->96050 96074 d71408 __fread_nolock 96049->96074 96151 dd359c 82 API calls __wsopen_s 96050->96151 96147 d6aceb 23 API calls messages 96051->96147 96146 d801f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96052->96146 96055 d71839 96148 d7d217 185 API calls 96055->96148 96058 db636e 96152 dd359c 82 API calls __wsopen_s 96058->96152 96060 d7152f 96061 db63d1 96060->96061 96062 d7153c 96060->96062 96154 de5745 54 API calls _wcslen 96061->96154 96063 d71940 9 API calls 96062->96063 96065 d71549 96063->96065 96071 d71940 9 API calls 96065->96071 96080 d715c7 messages 96065->96080 96066 d7fddb 22 API calls 96066->96074 96067 d7fe0b 22 API calls 96067->96074 96068 d71872 96068->96038 96149 d7faeb 23 API calls 96068->96149 96070 d7171d 96070->96031 96078 d71563 96071->96078 96074->96055 96074->96058 96074->96060 96074->96066 96074->96067 96075 db63b2 96074->96075 96074->96080 96120 d6ec40 96074->96120 96153 dd359c 82 API calls __wsopen_s 96075->96153 96078->96080 96155 d6a8c7 22 API calls __fread_nolock 96078->96155 96080->96068 96081 d7167b messages 96080->96081 96097 d71940 96080->96097 96107 dea2ea 96080->96107 96112 dd5c5a 96080->96112 96117 deac5b 96080->96117 96156 dd359c 82 API calls __wsopen_s 96080->96156 96081->96070 96144 d7ce17 22 API calls messages 96081->96144 96086->96031 96087->96031 96088->96004 96089->96009 96090->96032 96091->96032 96092->96032 96093->96032 96094->96032 96095->96030 96096->96032 96098 d71981 96097->96098 96099 d7195d 96097->96099 96157 d80242 5 API calls __Init_thread_wait 96098->96157 96106 d7196e 96099->96106 96159 d80242 5 API calls __Init_thread_wait 96099->96159 96101 d7198b 96101->96099 96158 d801f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96101->96158 96104 d78727 96104->96106 96160 d801f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96104->96160 96106->96080 96161 d67510 96107->96161 96111 dea315 96111->96080 96113 d67510 53 API calls 96112->96113 96114 dd5c6d 96113->96114 96209 dcdbbe lstrlenW 96114->96209 96116 dd5c77 96116->96080 96214 dead64 96117->96214 96119 deac6f 96119->96080 96122 d6ec76 messages 96120->96122 96121 d800a3 29 API calls pre_c_initialization 96121->96122 96122->96121 96123 db4beb 96122->96123 96124 d6fef7 96122->96124 96127 d6ed9d messages 96122->96127 96128 d7fddb 22 API calls 96122->96128 96129 db4b0b 96122->96129 96130 d6a8c7 22 API calls 96122->96130 96133 db4600 96122->96133 96137 d80242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96122->96137 96138 d6fbe3 96122->96138 96139 d6a961 22 API calls 96122->96139 96142 d801f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96122->96142 96143 d6f3ae messages 96122->96143 96246 d701e0 185 API calls 2 library calls 96122->96246 96247 d706a0 41 API calls messages 96122->96247 96253 dd359c 82 API calls __wsopen_s 96123->96253 96124->96127 96249 d6a8c7 22 API calls __fread_nolock 96124->96249 96127->96074 96128->96122 96251 dd359c 82 API calls __wsopen_s 96129->96251 96130->96122 96133->96127 96248 d6a8c7 22 API calls __fread_nolock 96133->96248 96137->96122 96138->96127 96140 db4bdc 96138->96140 96138->96143 96139->96122 96252 dd359c 82 API calls __wsopen_s 96140->96252 96142->96122 96143->96127 96250 dd359c 82 API calls __wsopen_s 96143->96250 96144->96081 96145->96042 96146->96048 96147->96055 96148->96068 96149->96068 96150->96044 96151->96080 96152->96080 96153->96080 96154->96078 96155->96080 96156->96080 96157->96101 96158->96099 96159->96104 96160->96106 96162 d67525 96161->96162 96163 d67522 96161->96163 96164 d6752d 96162->96164 96165 d6755b 96162->96165 96184 dcd4dc CreateToolhelp32Snapshot Process32FirstW 96163->96184 96194 d851c6 26 API calls 96164->96194 96166 da50f6 96165->96166 96168 d6756d 96165->96168 96175 da500f 96165->96175 96197 d85183 26 API calls 96166->96197 96195 d7fb21 51 API calls 96168->96195 96169 d6753d 96174 d7fddb 22 API calls 96169->96174 96172 da510e 96172->96172 96176 d67547 96174->96176 96178 d7fe0b 22 API calls 96175->96178 96183 da5088 96175->96183 96177 d69cb3 22 API calls 96176->96177 96177->96163 96179 da5058 96178->96179 96180 d7fddb 22 API calls 96179->96180 96181 da507f 96180->96181 96182 d69cb3 22 API calls 96181->96182 96182->96183 96196 d7fb21 51 API calls 96183->96196 96198 dcdef7 96184->96198 96186 dcd522 96187 dcd529 Process32NextW 96186->96187 96188 dcd5db FindCloseChangeNotification 96186->96188 96189 d6a961 22 API calls 96186->96189 96190 d69cb3 22 API calls 96186->96190 96204 d6525f 22 API calls 96186->96204 96205 d66350 22 API calls 96186->96205 96206 d7ce60 41 API calls 96186->96206 96187->96186 96187->96188 96188->96111 96189->96186 96190->96186 96194->96169 96195->96169 96196->96166 96197->96172 96199 dcdf02 96198->96199 96200 dcdf19 96199->96200 96203 dcdf1f 96199->96203 96207 d863b2 GetStringTypeW _strftime 96199->96207 96208 d862fb 39 API calls 96200->96208 96203->96186 96204->96186 96205->96186 96206->96186 96207->96199 96208->96203 96210 dcdbdc GetFileAttributesW 96209->96210 96211 dcdc06 96209->96211 96210->96211 96212 dcdbe8 FindFirstFileW 96210->96212 96211->96116 96212->96211 96213 dcdbf9 FindClose 96212->96213 96213->96211 96215 d6a961 22 API calls 96214->96215 96216 dead77 ___scrt_fastfail 96215->96216 96217 d67510 53 API calls 96216->96217 96231 deadce 96216->96231 96219 deadab 96217->96219 96218 deae3a 96227 deae4d ___scrt_fastfail 96218->96227 96245 d6b567 39 API calls 96218->96245 96224 d67510 53 API calls 96219->96224 96219->96231 96220 d67510 53 API calls 96222 deade4 96220->96222 96221 d67510 53 API calls 96233 deae04 96221->96233 96243 d67620 22 API calls _wcslen 96222->96243 96228 deadc4 96224->96228 96226 deadee 96226->96218 96226->96221 96230 d67510 53 API calls 96227->96230 96242 d67620 22 API calls _wcslen 96228->96242 96232 deae85 ShellExecuteExW 96230->96232 96231->96220 96231->96226 96236 deaeb0 96232->96236 96233->96218 96234 d67510 53 API calls 96233->96234 96235 deae28 96234->96235 96235->96218 96244 d6a8c7 22 API calls __fread_nolock 96235->96244 96238 deaec8 96236->96238 96239 deaf35 GetProcessId 96236->96239 96238->96119 96240 deaf48 96239->96240 96241 deaf58 CloseHandle 96240->96241 96241->96238 96242->96231 96243->96226 96244->96218 96245->96227 96246->96122 96247->96122 96248->96127 96249->96127 96250->96127 96251->96127 96252->96123 96253->96127 96254 d6105b 96259 d6344d 96254->96259 96256 d6106a 96290 d800a3 29 API calls __onexit 96256->96290 96258 d61074 96260 d6345d __wsopen_s 96259->96260 96261 d6a961 22 API calls 96260->96261 96262 d63513 96261->96262 96263 d63a5a 24 API calls 96262->96263 96264 d6351c 96263->96264 96291 d63357 96264->96291 96267 d633c6 22 API calls 96268 d63535 96267->96268 96269 d6515f 22 API calls 96268->96269 96270 d63544 96269->96270 96271 d6a961 22 API calls 96270->96271 96272 d6354d 96271->96272 96273 d6a6c3 22 API calls 96272->96273 96274 d63556 RegOpenKeyExW 96273->96274 96275 da3176 RegQueryValueExW 96274->96275 96279 d63578 96274->96279 96276 da320c RegCloseKey 96275->96276 96277 da3193 96275->96277 96276->96279 96289 da321e _wcslen 96276->96289 96278 d7fe0b 22 API calls 96277->96278 96280 da31ac 96278->96280 96279->96256 96281 d65722 22 API calls 96280->96281 96282 da31b7 RegQueryValueExW 96281->96282 96283 da31d4 96282->96283 96286 da31ee messages 96282->96286 96284 d66b57 22 API calls 96283->96284 96284->96286 96285 d64c6d 22 API calls 96285->96289 96286->96276 96287 d69cb3 22 API calls 96287->96289 96288 d6515f 22 API calls 96288->96289 96289->96279 96289->96285 96289->96287 96289->96288 96290->96258 96292 da1f50 __wsopen_s 96291->96292 96293 d63364 GetFullPathNameW 96292->96293 96294 d63386 96293->96294 96295 d66b57 22 API calls 96294->96295 96296 d633a4 96295->96296 96296->96267 96297 d61098 96302 d642de 96297->96302 96301 d610a7 96303 d6a961 22 API calls 96302->96303 96304 d642f5 GetVersionExW 96303->96304 96305 d66b57 22 API calls 96304->96305 96306 d64342 96305->96306 96307 d693b2 22 API calls 96306->96307 96309 d64378 96306->96309 96308 d6436c 96307->96308 96311 d637a0 22 API calls 96308->96311 96310 d6441b GetCurrentProcess IsWow64Process 96309->96310 96317 da37df 96309->96317 96312 d64437 96310->96312 96311->96309 96313 d6444f LoadLibraryA 96312->96313 96314 da3824 GetSystemInfo 96312->96314 96315 d64460 GetProcAddress 96313->96315 96316 d6449c GetSystemInfo 96313->96316 96315->96316 96318 d64470 GetNativeSystemInfo 96315->96318 96319 d64476 96316->96319 96318->96319 96320 d6109d 96319->96320 96321 d6447a FreeLibrary 96319->96321 96322 d800a3 29 API calls __onexit 96320->96322 96321->96320 96322->96301 96323 db3f75 96334 d7ceb1 96323->96334 96325 db3f8b 96326 db4006 96325->96326 96401 d7e300 23 API calls 96325->96401 96343 d6bf40 96326->96343 96329 db4052 96332 db4a88 96329->96332 96403 dd359c 82 API calls __wsopen_s 96329->96403 96330 db3fe6 96330->96329 96402 dd1abf 22 API calls 96330->96402 96335 d7ced2 96334->96335 96336 d7cebf 96334->96336 96338 d7ced7 96335->96338 96339 d7cf05 96335->96339 96404 d6aceb 23 API calls messages 96336->96404 96341 d7fddb 22 API calls 96338->96341 96405 d6aceb 23 API calls messages 96339->96405 96342 d7cec9 96341->96342 96342->96325 96406 d6adf0 96343->96406 96345 d6bf9d 96346 db04b6 96345->96346 96347 d6bfa9 96345->96347 96425 dd359c 82 API calls __wsopen_s 96346->96425 96349 db04c6 96347->96349 96350 d6c01e 96347->96350 96426 dd359c 82 API calls __wsopen_s 96349->96426 96411 d6ac91 96350->96411 96353 d6c7da 96357 d7fe0b 22 API calls 96353->96357 96362 d6c808 __fread_nolock 96357->96362 96359 db04f5 96363 db055a 96359->96363 96427 d7d217 185 API calls 96359->96427 96367 d7fe0b 22 API calls 96362->96367 96400 d6c603 96363->96400 96428 dd359c 82 API calls __wsopen_s 96363->96428 96364 d6ec40 185 API calls 96385 d6c039 __fread_nolock messages 96364->96385 96365 dc7120 22 API calls 96365->96385 96366 db091a 96438 dd3209 23 API calls 96366->96438 96387 d6c350 __fread_nolock messages 96367->96387 96368 d6af8a 22 API calls 96368->96385 96371 db08a5 96372 d6ec40 185 API calls 96371->96372 96374 db08cf 96372->96374 96374->96400 96436 d6a81b 41 API calls 96374->96436 96375 db0591 96429 dd359c 82 API calls __wsopen_s 96375->96429 96376 db08f6 96437 dd359c 82 API calls __wsopen_s 96376->96437 96381 d6c3ac 96381->96329 96383 d6c237 96384 d6c253 96383->96384 96439 d6a8c7 22 API calls __fread_nolock 96383->96439 96389 db0976 96384->96389 96394 d6c297 messages 96384->96394 96385->96353 96385->96359 96385->96362 96385->96363 96385->96364 96385->96365 96385->96366 96385->96368 96385->96371 96385->96375 96385->96376 96385->96383 96386 d7fe0b 22 API calls 96385->96386 96392 db09bf 96385->96392 96393 d7fddb 22 API calls 96385->96393 96397 d6bbe0 40 API calls 96385->96397 96385->96400 96415 d6ad81 96385->96415 96430 dc7099 22 API calls __fread_nolock 96385->96430 96431 de5745 54 API calls _wcslen 96385->96431 96432 d7aa42 22 API calls messages 96385->96432 96433 dcf05c 40 API calls 96385->96433 96434 d6a993 41 API calls 96385->96434 96435 d6aceb 23 API calls messages 96385->96435 96386->96385 96387->96381 96424 d7ce17 22 API calls messages 96387->96424 96440 d6aceb 23 API calls messages 96389->96440 96392->96400 96441 dd359c 82 API calls __wsopen_s 96392->96441 96393->96385 96394->96392 96422 d6aceb 23 API calls messages 96394->96422 96396 d6c335 96396->96392 96398 d6c342 96396->96398 96397->96385 96423 d6a704 22 API calls messages 96398->96423 96400->96329 96401->96330 96402->96326 96403->96332 96404->96342 96405->96342 96407 d6ae01 96406->96407 96410 d6ae1c messages 96406->96410 96408 d6aec9 22 API calls 96407->96408 96409 d6ae09 CharUpperBuffW 96408->96409 96409->96410 96410->96345 96413 d6acae 96411->96413 96412 d6acd1 96412->96385 96413->96412 96442 dd359c 82 API calls __wsopen_s 96413->96442 96416 dafadb 96415->96416 96417 d6ad92 96415->96417 96418 d7fddb 22 API calls 96417->96418 96419 d6ad99 96418->96419 96443 d6adcd 96419->96443 96422->96396 96423->96387 96424->96387 96425->96349 96426->96400 96427->96363 96428->96400 96429->96400 96430->96385 96431->96385 96432->96385 96433->96385 96434->96385 96435->96385 96436->96376 96437->96400 96438->96383 96439->96384 96440->96392 96441->96400 96442->96412 96447 d6addd 96443->96447 96444 d6adb6 96444->96385 96445 d7fddb 22 API calls 96445->96447 96446 d6a961 22 API calls 96446->96447 96447->96444 96447->96445 96447->96446 96449 d6adcd 22 API calls 96447->96449 96450 d6a8c7 22 API calls __fread_nolock 96447->96450 96449->96447 96450->96447 96451 d61044 96456 d610f3 96451->96456 96453 d6104a 96492 d800a3 29 API calls __onexit 96453->96492 96455 d61054 96493 d61398 96456->96493 96460 d6116a 96461 d6a961 22 API calls 96460->96461 96462 d61174 96461->96462 96463 d6a961 22 API calls 96462->96463 96464 d6117e 96463->96464 96465 d6a961 22 API calls 96464->96465 96466 d61188 96465->96466 96467 d6a961 22 API calls 96466->96467 96468 d611c6 96467->96468 96469 d6a961 22 API calls 96468->96469 96470 d61292 96469->96470 96503 d6171c 96470->96503 96474 d612c4 96475 d6a961 22 API calls 96474->96475 96476 d612ce 96475->96476 96477 d71940 9 API calls 96476->96477 96478 d612f9 96477->96478 96524 d61aab 96478->96524 96480 d61315 96481 d61325 GetStdHandle 96480->96481 96482 d6137a 96481->96482 96483 da2485 96481->96483 96486 d61387 OleInitialize 96482->96486 96483->96482 96484 da248e 96483->96484 96485 d7fddb 22 API calls 96484->96485 96487 da2495 96485->96487 96486->96453 96531 dd011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 96487->96531 96489 da249e 96532 dd0944 CreateThread 96489->96532 96491 da24aa CloseHandle 96491->96482 96492->96455 96533 d613f1 96493->96533 96496 d613f1 22 API calls 96497 d613d0 96496->96497 96498 d6a961 22 API calls 96497->96498 96499 d613dc 96498->96499 96500 d66b57 22 API calls 96499->96500 96501 d61129 96500->96501 96502 d61bc3 6 API calls 96501->96502 96502->96460 96504 d6a961 22 API calls 96503->96504 96505 d6172c 96504->96505 96506 d6a961 22 API calls 96505->96506 96507 d61734 96506->96507 96508 d6a961 22 API calls 96507->96508 96509 d6174f 96508->96509 96510 d7fddb 22 API calls 96509->96510 96511 d6129c 96510->96511 96512 d61b4a 96511->96512 96513 d61b58 96512->96513 96514 d6a961 22 API calls 96513->96514 96515 d61b63 96514->96515 96516 d6a961 22 API calls 96515->96516 96517 d61b6e 96516->96517 96518 d6a961 22 API calls 96517->96518 96519 d61b79 96518->96519 96520 d6a961 22 API calls 96519->96520 96521 d61b84 96520->96521 96522 d7fddb 22 API calls 96521->96522 96523 d61b96 RegisterWindowMessageW 96522->96523 96523->96474 96525 da272d 96524->96525 96526 d61abb 96524->96526 96540 dd3209 23 API calls 96525->96540 96527 d7fddb 22 API calls 96526->96527 96529 d61ac3 96527->96529 96529->96480 96530 da2738 96531->96489 96532->96491 96541 dd092a 28 API calls 96532->96541 96534 d6a961 22 API calls 96533->96534 96535 d613fc 96534->96535 96536 d6a961 22 API calls 96535->96536 96537 d61404 96536->96537 96538 d6a961 22 API calls 96537->96538 96539 d613c6 96538->96539 96539->96496 96540->96530 96542 d62de3 96543 d62df0 __wsopen_s 96542->96543 96544 da2c2b ___scrt_fastfail 96543->96544 96545 d62e09 96543->96545 96547 da2c47 GetOpenFileNameW 96544->96547 96546 d63aa2 23 API calls 96545->96546 96548 d62e12 96546->96548 96549 da2c96 96547->96549 96558 d62da5 96548->96558 96551 d66b57 22 API calls 96549->96551 96553 da2cab 96551->96553 96553->96553 96555 d62e27 96576 d644a8 96555->96576 96559 da1f50 __wsopen_s 96558->96559 96560 d62db2 GetLongPathNameW 96559->96560 96561 d66b57 22 API calls 96560->96561 96562 d62dda 96561->96562 96563 d63598 96562->96563 96564 d6a961 22 API calls 96563->96564 96565 d635aa 96564->96565 96566 d63aa2 23 API calls 96565->96566 96567 d635b5 96566->96567 96568 da32eb 96567->96568 96569 d635c0 96567->96569 96573 da330d 96568->96573 96612 d7ce60 41 API calls 96568->96612 96570 d6515f 22 API calls 96569->96570 96572 d635cc 96570->96572 96606 d635f3 96572->96606 96575 d635df 96575->96555 96577 d64ecb 94 API calls 96576->96577 96578 d644cd 96577->96578 96579 da3833 96578->96579 96580 d64ecb 94 API calls 96578->96580 96581 dd2cf9 80 API calls 96579->96581 96582 d644e1 96580->96582 96583 da3848 96581->96583 96582->96579 96586 d644e9 96582->96586 96584 da3869 96583->96584 96585 da384c 96583->96585 96588 d7fe0b 22 API calls 96584->96588 96587 d64f39 68 API calls 96585->96587 96589 d644f5 96586->96589 96590 da3854 96586->96590 96587->96590 96602 da38ae 96588->96602 96613 d6940c 136 API calls 2 library calls 96589->96613 96614 dcda5a 82 API calls 96590->96614 96593 da3862 96593->96584 96594 d62e31 96595 da3a5f 96600 da3a67 96595->96600 96596 d64f39 68 API calls 96596->96600 96600->96596 96620 dc989b 82 API calls __wsopen_s 96600->96620 96602->96595 96602->96600 96603 d69cb3 22 API calls 96602->96603 96615 dc967e 22 API calls __fread_nolock 96602->96615 96616 dc95ad 42 API calls _wcslen 96602->96616 96617 dd0b5a 22 API calls 96602->96617 96618 d6a4a1 22 API calls __fread_nolock 96602->96618 96619 d63ff7 22 API calls 96602->96619 96603->96602 96607 d63605 96606->96607 96611 d63624 __fread_nolock 96606->96611 96609 d7fe0b 22 API calls 96607->96609 96608 d7fddb 22 API calls 96610 d6363b 96608->96610 96609->96611 96610->96575 96611->96608 96612->96568 96613->96594 96614->96593 96615->96602 96616->96602 96617->96602 96618->96602 96619->96602 96620->96600 96621 da2402 96624 d61410 96621->96624 96625 da24b8 DestroyWindow 96624->96625 96626 d6144f mciSendStringW 96624->96626 96639 da24c4 96625->96639 96627 d616c6 96626->96627 96628 d6146b 96626->96628 96627->96628 96630 d616d5 UnregisterHotKey 96627->96630 96629 d61479 96628->96629 96628->96639 96657 d6182e 96629->96657 96630->96627 96632 da2509 96638 da251c FreeLibrary 96632->96638 96640 da252d 96632->96640 96633 da24d8 96633->96639 96663 d66246 CloseHandle 96633->96663 96634 da24e2 FindClose 96634->96639 96637 d6148e 96637->96640 96645 d6149c 96637->96645 96638->96632 96639->96632 96639->96633 96639->96634 96641 da2541 VirtualFree 96640->96641 96648 d61509 96640->96648 96641->96640 96642 d614f8 OleUninitialize 96642->96648 96643 d61514 96647 d61524 96643->96647 96644 da2589 96650 da2598 messages 96644->96650 96664 dd32eb 6 API calls messages 96644->96664 96645->96642 96661 d61944 VirtualFreeEx CloseHandle 96647->96661 96648->96643 96648->96644 96653 da2627 96650->96653 96665 dc64d4 22 API calls messages 96650->96665 96652 d6153a 96652->96650 96654 d6161f 96652->96654 96653->96653 96654->96653 96662 d61876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 96654->96662 96656 d616c1 96658 d6183b 96657->96658 96659 d61480 96658->96659 96666 dc702a 22 API calls 96658->96666 96659->96632 96659->96637 96661->96652 96662->96656 96663->96633 96664->96644 96665->96650 96666->96658 96667 d61cad SystemParametersInfoW 96668 db2a00 96682 d6d7b0 messages 96668->96682 96669 d6db11 PeekMessageW 96669->96682 96670 d6d807 GetInputState 96670->96669 96670->96682 96671 db1cbe TranslateAcceleratorW 96671->96682 96673 d6db73 TranslateMessage DispatchMessageW 96674 d6db8f PeekMessageW 96673->96674 96674->96682 96675 d6da04 timeGetTime 96675->96682 96676 d6dbaf Sleep 96693 d6dbc0 96676->96693 96677 db2b74 Sleep 96677->96693 96678 d7e551 timeGetTime 96678->96693 96679 db1dda timeGetTime 96709 d7e300 23 API calls 96679->96709 96681 dcd4dc 47 API calls 96681->96693 96682->96669 96682->96670 96682->96671 96682->96673 96682->96674 96682->96675 96682->96676 96682->96677 96682->96679 96686 d6d9d5 96682->96686 96696 d6ec40 185 API calls 96682->96696 96697 d6bf40 185 API calls 96682->96697 96698 d71310 185 API calls 96682->96698 96700 d6dd50 96682->96700 96707 d6dfd0 185 API calls 3 library calls 96682->96707 96708 d7edf6 IsDialogMessageW GetClassLongW 96682->96708 96710 dd3a2a 23 API calls 96682->96710 96711 dd359c 82 API calls __wsopen_s 96682->96711 96683 db2c0b GetExitCodeProcess 96687 db2c21 WaitForSingleObject 96683->96687 96688 db2c37 CloseHandle 96683->96688 96684 df29bf GetForegroundWindow 96684->96693 96687->96682 96687->96688 96688->96693 96689 db2a31 96689->96686 96690 db2ca9 Sleep 96690->96682 96693->96678 96693->96681 96693->96682 96693->96683 96693->96684 96693->96686 96693->96689 96693->96690 96712 de5658 23 API calls 96693->96712 96713 dce97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 96693->96713 96696->96682 96697->96682 96698->96682 96701 d6dd83 96700->96701 96702 d6dd6f 96700->96702 96746 dd359c 82 API calls __wsopen_s 96701->96746 96714 d6d260 96702->96714 96704 d6dd7a 96704->96682 96706 db2f75 96706->96706 96707->96682 96708->96682 96709->96682 96710->96682 96711->96682 96712->96693 96713->96693 96715 d6ec40 185 API calls 96714->96715 96731 d6d29d 96715->96731 96716 d6d30b messages 96716->96704 96718 d6d3c3 96720 d6d3ce 96718->96720 96724 d6d6d5 96718->96724 96719 d6d5ff 96722 d6d614 96719->96722 96723 db1bb5 96719->96723 96721 d7fddb 22 API calls 96720->96721 96733 d6d3d5 __fread_nolock 96721->96733 96726 d7fddb 22 API calls 96722->96726 96752 de5705 23 API calls 96723->96752 96724->96716 96728 d7fe0b 22 API calls 96724->96728 96725 d6d4b8 96729 d7fe0b 22 API calls 96725->96729 96738 d6d46a 96726->96738 96728->96733 96741 d6d429 __fread_nolock messages 96729->96741 96730 db1bc4 96753 dd359c 82 API calls __wsopen_s 96730->96753 96731->96716 96731->96718 96731->96724 96731->96725 96731->96730 96734 d7fddb 22 API calls 96731->96734 96731->96741 96732 d7fddb 22 API calls 96735 d6d3f6 96732->96735 96733->96732 96733->96735 96734->96731 96735->96741 96747 d6bec0 185 API calls 96735->96747 96737 db1ba4 96751 dd359c 82 API calls __wsopen_s 96737->96751 96738->96704 96741->96719 96741->96737 96741->96738 96742 db1b7f 96741->96742 96744 db1b5d 96741->96744 96748 d61f6f 185 API calls 96741->96748 96750 dd359c 82 API calls __wsopen_s 96742->96750 96749 dd359c 82 API calls __wsopen_s 96744->96749 96746->96706 96747->96741 96748->96741 96749->96738 96750->96738 96751->96738 96752->96730 96753->96716 96754 d98402 96759 d981be 96754->96759 96757 d9842a 96760 d981ef try_get_first_available_module 96759->96760 96767 d98338 96760->96767 96774 d88e0b 40 API calls 2 library calls 96760->96774 96762 d983ee 96778 d927ec 26 API calls pre_c_initialization 96762->96778 96764 d98343 96764->96757 96771 da0984 96764->96771 96766 d9838c 96766->96767 96775 d88e0b 40 API calls 2 library calls 96766->96775 96767->96764 96777 d8f2d9 20 API calls __dosmaperr 96767->96777 96769 d983ab 96769->96767 96776 d88e0b 40 API calls 2 library calls 96769->96776 96779 da0081 96771->96779 96773 da099f 96773->96757 96774->96766 96775->96769 96776->96767 96777->96762 96778->96764 96782 da008d __FrameHandler3::FrameUnwindToState 96779->96782 96780 da009b 96836 d8f2d9 20 API calls __dosmaperr 96780->96836 96782->96780 96784 da00d4 96782->96784 96783 da00a0 96837 d927ec 26 API calls pre_c_initialization 96783->96837 96790 da065b 96784->96790 96789 da00aa __fread_nolock 96789->96773 96791 da0678 96790->96791 96792 da068d 96791->96792 96793 da06a6 96791->96793 96853 d8f2c6 20 API calls __dosmaperr 96792->96853 96839 d95221 96793->96839 96796 da06ab 96797 da06cb 96796->96797 96798 da06b4 96796->96798 96852 da039a CreateFileW 96797->96852 96855 d8f2c6 20 API calls __dosmaperr 96798->96855 96802 da00f8 96838 da0121 LeaveCriticalSection __wsopen_s 96802->96838 96803 da06b9 96856 d8f2d9 20 API calls __dosmaperr 96803->96856 96805 da0781 GetFileType 96807 da078c GetLastError 96805->96807 96808 da07d3 96805->96808 96806 da0756 GetLastError 96858 d8f2a3 20 API calls 2 library calls 96806->96858 96859 d8f2a3 20 API calls 2 library calls 96807->96859 96861 d9516a 21 API calls 3 library calls 96808->96861 96809 da0692 96854 d8f2d9 20 API calls __dosmaperr 96809->96854 96810 da0704 96810->96805 96810->96806 96857 da039a CreateFileW 96810->96857 96814 da079a CloseHandle 96814->96809 96817 da07c3 96814->96817 96816 da0749 96816->96805 96816->96806 96860 d8f2d9 20 API calls __dosmaperr 96817->96860 96818 da07f4 96820 da0840 96818->96820 96862 da05ab 72 API calls 4 library calls 96818->96862 96825 da086d 96820->96825 96863 da014d 72 API calls 4 library calls 96820->96863 96821 da07c8 96821->96809 96824 da0866 96824->96825 96826 da087e 96824->96826 96827 d986ae __wsopen_s 29 API calls 96825->96827 96826->96802 96828 da08fc CloseHandle 96826->96828 96827->96802 96864 da039a CreateFileW 96828->96864 96830 da0927 96831 da095d 96830->96831 96832 da0931 GetLastError 96830->96832 96831->96802 96865 d8f2a3 20 API calls 2 library calls 96832->96865 96834 da093d 96866 d95333 21 API calls 3 library calls 96834->96866 96836->96783 96837->96789 96838->96789 96840 d9522d __FrameHandler3::FrameUnwindToState 96839->96840 96867 d92f5e EnterCriticalSection 96840->96867 96842 d95234 96844 d95259 96842->96844 96848 d952c7 EnterCriticalSection 96842->96848 96850 d9527b 96842->96850 96845 d95000 __wsopen_s 21 API calls 96844->96845 96846 d9525e 96845->96846 96846->96850 96871 d95147 EnterCriticalSection 96846->96871 96847 d952a4 __fread_nolock 96847->96796 96848->96850 96851 d952d4 LeaveCriticalSection 96848->96851 96868 d9532a 96850->96868 96851->96842 96852->96810 96853->96809 96854->96802 96855->96803 96856->96809 96857->96816 96858->96809 96859->96814 96860->96821 96861->96818 96862->96820 96863->96824 96864->96830 96865->96834 96866->96831 96867->96842 96872 d92fa6 LeaveCriticalSection 96868->96872 96870 d95331 96870->96847 96871->96850 96872->96870 96873 da2ba5 96874 d62b25 96873->96874 96875 da2baf 96873->96875 96901 d62b83 7 API calls 96874->96901 96877 d63a5a 24 API calls 96875->96877 96879 da2bb8 96877->96879 96881 d69cb3 22 API calls 96879->96881 96883 da2bc6 96881->96883 96882 d62b2f 96888 d63837 49 API calls 96882->96888 96892 d62b44 96882->96892 96884 da2bce 96883->96884 96885 da2bf5 96883->96885 96886 d633c6 22 API calls 96884->96886 96887 d633c6 22 API calls 96885->96887 96889 da2bd9 96886->96889 96890 da2bf1 GetForegroundWindow ShellExecuteW 96887->96890 96888->96892 96905 d66350 22 API calls 96889->96905 96897 da2c26 96890->96897 96891 d62b5f 96899 d62b66 SetCurrentDirectoryW 96891->96899 96892->96891 96895 d630f2 Shell_NotifyIconW 96892->96895 96895->96891 96896 da2be7 96898 d633c6 22 API calls 96896->96898 96897->96891 96898->96890 96900 d62b7a 96899->96900 96906 d62cd4 7 API calls 96901->96906 96903 d62b2a 96904 d62c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 96903->96904 96904->96882 96905->96896 96906->96903

                                                                                            Executed Functions

                                                                                            Function 00D642DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 234 d642de-d6434d call d6a961 GetVersionExW call d66b57 239 d64353 234->239 240 da3617-da362a 234->240 241 d64355-d64357 239->241 242 da362b-da362f 240->242 243 d6435d-d643bc call d693b2 call d637a0 241->243 244 da3656 241->244 245 da3632-da363e 242->245 246 da3631 242->246 263 d643c2-d643c4 243->263 264 da37df-da37e6 243->264 250 da365d-da3660 244->250 245->242 247 da3640-da3642 245->247 246->245 247->241 249 da3648-da364f 247->249 249->240 252 da3651 249->252 253 da3666-da36a8 250->253 254 d6441b-d64435 GetCurrentProcess IsWow64Process 250->254 252->244 253->254 258 da36ae-da36b1 253->258 256 d64437 254->256 257 d64494-d6449a 254->257 260 d6443d-d64449 256->260 257->260 261 da36db-da36e5 258->261 262 da36b3-da36bd 258->262 265 d6444f-d6445e LoadLibraryA 260->265 266 da3824-da3828 GetSystemInfo 260->266 270 da36f8-da3702 261->270 271 da36e7-da36f3 261->271 267 da36ca-da36d6 262->267 268 da36bf-da36c5 262->268 263->250 269 d643ca-d643dd 263->269 272 da37e8 264->272 273 da3806-da3809 264->273 278 d64460-d6446e GetProcAddress 265->278 279 d6449c-d644a6 GetSystemInfo 265->279 267->254 268->254 280 d643e3-d643e5 269->280 281 da3726-da372f 269->281 274 da3704-da3710 270->274 275 da3715-da3721 270->275 271->254 282 da37ee 272->282 276 da380b-da381a 273->276 277 da37f4-da37fc 273->277 274->254 275->254 276->282 285 da381c-da3822 276->285 277->273 278->279 286 d64470-d64474 GetNativeSystemInfo 278->286 287 d64476-d64478 279->287 288 da374d-da3762 280->288 289 d643eb-d643ee 280->289 283 da373c-da3748 281->283 284 da3731-da3737 281->284 282->277 283->254 284->254 285->277 286->287 294 d64481-d64493 287->294 295 d6447a-d6447b FreeLibrary 287->295 292 da376f-da377b 288->292 293 da3764-da376a 288->293 290 d643f4-d6440f 289->290 291 da3791-da3794 289->291 296 d64415 290->296 297 da3780-da378c 290->297 291->254 298 da379a-da37c1 291->298 292->254 293->254 295->294 296->254 297->254 299 da37ce-da37da 298->299 300 da37c3-da37c9 298->300 299->254 300->254
                                                                                            APIs
                                                                                            • GetVersionExW.KERNEL32(?), ref: 00D6430D
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • GetCurrentProcess.KERNEL32(?,00DFCB64,00000000,?,?), ref: 00D64422
                                                                                            • IsWow64Process.KERNEL32(00000000,?,?), ref: 00D64429
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00D64454
                                                                                            • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D64466
                                                                                            • GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00D64474
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?), ref: 00D6447B
                                                                                            • GetSystemInfo.KERNEL32(?,?,?), ref: 00D644A0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                                            • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                                            • API String ID: 3290436268-3101561225
                                                                                            • Opcode ID: 07f8518135965756d2d7ba0dcd0b25ced8ad042d56ea639f27de21e849415830
                                                                                            • Instruction ID: 2033620defc0d5b774ddbf600fad0bbcb1b7216e8c8af4f08a9fba55b40b9c4d
                                                                                            • Opcode Fuzzy Hash: 07f8518135965756d2d7ba0dcd0b25ced8ad042d56ea639f27de21e849415830
                                                                                            • Instruction Fuzzy Hash: 5EA1916291A3CCDFC711CB7B7C491A57FE56B26340B1A98EDE081B3B62D660950CCB32
                                                                                            Function 00D642A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 638 d642a2-d642ba CreateStreamOnHGlobal 639 d642bc-d642d3 FindResourceExW 638->639 640 d642da-d642dd 638->640 641 da35ba-da35c9 LoadResource 639->641 642 d642d9 639->642 641->642 643 da35cf-da35dd SizeofResource 641->643 642->640 643->642 644 da35e3-da35ee LockResource 643->644 644->642 645 da35f4-da3612 644->645 645->642
                                                                                            APIs
                                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D650AA,?,?,00000000,00000000), ref: 00D642B2
                                                                                            • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D650AA,?,?,00000000,00000000), ref: 00D642C9
                                                                                            • LoadResource.KERNEL32(?,00000000,?,?,00D650AA,?,?,00000000,00000000,?,?,?,?,?,?,00D64F20), ref: 00DA35BE
                                                                                            • SizeofResource.KERNEL32(?,00000000,?,?,00D650AA,?,?,00000000,00000000,?,?,?,?,?,?,00D64F20), ref: 00DA35D3
                                                                                            • LockResource.KERNEL32(00D650AA,?,?,00D650AA,?,?,00000000,00000000,?,?,?,?,?,?,00D64F20,?), ref: 00DA35E6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                            • String ID: SCRIPT
                                                                                            • API String ID: 3051347437-3967369404
                                                                                            • Opcode ID: a7d397675249dab697039797aac9d30c7534dcf030e934444fcb5fb8f11e3e8d
                                                                                            • Instruction ID: 022d86c1a005e924e0dce764e7ca8df45e98b4721f3bbb8f15265a3d655a4203
                                                                                            • Opcode Fuzzy Hash: a7d397675249dab697039797aac9d30c7534dcf030e934444fcb5fb8f11e3e8d
                                                                                            • Instruction Fuzzy Hash: C0117C70201704BFD7218B65DD58F277BB9EBC9B51F248169F402DA250DB71DC24C634
                                                                                            Function 00DA2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00D62B6B
                                                                                              • Part of subcall function 00D63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E31418,?,00D62E7F,?,?,?,00000000), ref: 00D63A78
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • GetForegroundWindow.USER32(runas,?,?,?,?,?,00E22224), ref: 00DA2C10
                                                                                            • ShellExecuteW.SHELL32(00000000,?,?,00E22224), ref: 00DA2C17
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                                                            • String ID: runas
                                                                                            • API String ID: 448630720-4000483414
                                                                                            • Opcode ID: 89c2d080884ed4a2f66cf9fb3e0726609a47b5d5943d8902b1f9920a1fa4467d
                                                                                            • Instruction ID: d57d98fa8be1374110dfb62bdfa72ed2c6118070918805c1277642d7161fb8be
                                                                                            • Opcode Fuzzy Hash: 89c2d080884ed4a2f66cf9fb3e0726609a47b5d5943d8902b1f9920a1fa4467d
                                                                                            • Instruction Fuzzy Hash: 8111E931208345ABC704FF68E9569BEBBA4DFD5340F08242DF092631A6DF318A49D732
                                                                                            Function 00DCD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1153 dcd4dc-dcd524 CreateToolhelp32Snapshot Process32FirstW call dcdef7 1156 dcd5d2-dcd5d5 1153->1156 1157 dcd529-dcd538 Process32NextW 1156->1157 1158 dcd5db-dcd5ea FindCloseChangeNotification 1156->1158 1157->1158 1159 dcd53e-dcd5ad call d6a961 * 2 call d69cb3 call d6525f call d6988f call d66350 call d7ce60 1157->1159 1174 dcd5af-dcd5b1 1159->1174 1175 dcd5b7-dcd5be 1159->1175 1176 dcd5c0-dcd5cd call d6988f * 2 1174->1176 1177 dcd5b3-dcd5b5 1174->1177 1175->1176 1176->1156 1177->1175 1177->1176
                                                                                            APIs
                                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00DCD501
                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00DCD50F
                                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00DCD52F
                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 00DCD5DC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                                                                            • String ID:
                                                                                            • API String ID: 3243318325-0
                                                                                            • Opcode ID: 5cace15253eeb111a1bbc46921b262949a3eed87e6b46860c73f16af519cf028
                                                                                            • Instruction ID: 717c6d516daa1c504601a989fe2e3244f8ed8a34ce9d10f5559686ae43996114
                                                                                            • Opcode Fuzzy Hash: 5cace15253eeb111a1bbc46921b262949a3eed87e6b46860c73f16af519cf028
                                                                                            • Instruction Fuzzy Hash: A9316A711083419FD301EF54C891AABBBE8EF9A354F14092DF585972A1EB719948CBB2
                                                                                            Function 00DCDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1181 dcdbbe-dcdbda lstrlenW 1182 dcdbdc-dcdbe6 GetFileAttributesW 1181->1182 1183 dcdc06 1181->1183 1184 dcdbe8-dcdbf7 FindFirstFileW 1182->1184 1185 dcdc09-dcdc0d 1182->1185 1183->1185 1184->1183 1186 dcdbf9-dcdc04 FindClose 1184->1186 1186->1185
                                                                                            APIs
                                                                                            • lstrlenW.KERNEL32(?,00DA5222), ref: 00DCDBCE
                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00DCDBDD
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DCDBEE
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DCDBFA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                                            • String ID:
                                                                                            • API String ID: 2695905019-0
                                                                                            • Opcode ID: ba18d982cd1e5699b8b26f429303fd2d18fbdad66b163765efbe793a18a69032
                                                                                            • Instruction ID: e75fe5fa81216fa47f9b78207ac086f237d3160af7607eeae5576325bf9cfa1b
                                                                                            • Opcode Fuzzy Hash: ba18d982cd1e5699b8b26f429303fd2d18fbdad66b163765efbe793a18a69032
                                                                                            • Instruction Fuzzy Hash: 1EF0A7304206155782206B789E0D97A377D9E05334B188716F475C21E0EBB06964C5B9
                                                                                            Function 00D84CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(00D928E9,?,00D84CBE,00D928E9,00E288B8,0000000C,00D84E15,00D928E9,00000002,00000000,?,00D928E9), ref: 00D84D09
                                                                                            • TerminateProcess.KERNEL32(00000000,?,00D84CBE,00D928E9,00E288B8,0000000C,00D84E15,00D928E9,00000002,00000000,?,00D928E9), ref: 00D84D10
                                                                                            • ExitProcess.KERNEL32 ref: 00D84D22
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                            • String ID:
                                                                                            • API String ID: 1703294689-0
                                                                                            • Opcode ID: 774558948a894e9562e79af83b2f2601b99e0cb6c59ce1b6ff757308c058a905
                                                                                            • Instruction ID: 6b4c51fc9c79fefbbaca2b59bebb5201670582a169af923aeddfa728ff766e15
                                                                                            • Opcode Fuzzy Hash: 774558948a894e9562e79af83b2f2601b99e0cb6c59ce1b6ff757308c058a905
                                                                                            • Instruction Fuzzy Hash: 78E0B631010249ABCF12BF54DE09A687B69EB41795B148014FC05CA222CB35ED62DBB0
                                                                                            Function 00D6BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharUpper
                                                                                            • String ID: p#
                                                                                            • API String ID: 3964851224-4182048217
                                                                                            • Opcode ID: efa67c0d615a3009dde96092cd3d08930836b8eb9b759b46874457015fd4ac64
                                                                                            • Instruction ID: 64a8ea1658b364150941387be16c3e1a860e7cb6be7aa3b321d3c0cc262b9e5c
                                                                                            • Opcode Fuzzy Hash: efa67c0d615a3009dde96092cd3d08930836b8eb9b759b46874457015fd4ac64
                                                                                            • Instruction Fuzzy Hash: 55A23570618341DFD720DF18C480B6ABBE1BF89304F18996DE9DA9B352D771E845CBA2
                                                                                            Function 00D6D730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetInputState.USER32 ref: 00D6D807
                                                                                            • timeGetTime.WINMM ref: 00D6DA07
                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D6DB28
                                                                                            • TranslateMessage.USER32(?), ref: 00D6DB7B
                                                                                            • DispatchMessageW.USER32(?), ref: 00D6DB89
                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D6DB9F
                                                                                            • Sleep.KERNEL32(0000000A), ref: 00D6DBB1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                                                            • String ID:
                                                                                            • API String ID: 2189390790-0
                                                                                            • Opcode ID: 288419cb701c73fb6f1493e4a3e0536aa663b566c1d106199a25475ac953077d
                                                                                            • Instruction ID: ad7175388ec8ceca161cdaee4ead3ff9300f07b84fc3886f8b8c1e566b95d549
                                                                                            • Opcode Fuzzy Hash: 288419cb701c73fb6f1493e4a3e0536aa663b566c1d106199a25475ac953077d
                                                                                            • Instruction Fuzzy Hash: B742AF31A08345DFD728CF25D894BBABBA2FF55304F18855EE49687291D770E848CBB2
                                                                                            Function 00D62CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00D62D07
                                                                                            • RegisterClassExW.USER32(00000030), ref: 00D62D31
                                                                                            • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D62D42
                                                                                            • InitCommonControlsEx.COMCTL32(?), ref: 00D62D5F
                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D62D6F
                                                                                            • LoadIconW.USER32(000000A9), ref: 00D62D85
                                                                                            • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D62D94
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                            • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                            • API String ID: 2914291525-1005189915
                                                                                            • Opcode ID: 21430ca9d66d742169469f730c917d63a56a7d45ab15a6fc00e5267b168f2873
                                                                                            • Instruction ID: ec8478f7f9be6202bdfc1827f7d7786b4adbba64dabb79e15524ef5fff99fd08
                                                                                            • Opcode Fuzzy Hash: 21430ca9d66d742169469f730c917d63a56a7d45ab15a6fc00e5267b168f2873
                                                                                            • Instruction Fuzzy Hash: 1821D0B191130CAFDB009FA5E949BADBFB4FB08700F10915AE611F62A0D7B11558CFA0
                                                                                            Function 00DA065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 302 da065b-da068b call da042f 305 da068d-da0698 call d8f2c6 302->305 306 da06a6-da06b2 call d95221 302->306 311 da069a-da06a1 call d8f2d9 305->311 312 da06cb-da0714 call da039a 306->312 313 da06b4-da06c9 call d8f2c6 call d8f2d9 306->313 320 da097d-da0983 311->320 322 da0781-da078a GetFileType 312->322 323 da0716-da071f 312->323 313->311 326 da078c-da07bd GetLastError call d8f2a3 CloseHandle 322->326 327 da07d3-da07d6 322->327 324 da0721-da0725 323->324 325 da0756-da077c GetLastError call d8f2a3 323->325 324->325 329 da0727-da0754 call da039a 324->329 325->311 326->311 341 da07c3-da07ce call d8f2d9 326->341 332 da07d8-da07dd 327->332 333 da07df-da07e5 327->333 329->322 329->325 334 da07e9-da0837 call d9516a 332->334 333->334 335 da07e7 333->335 344 da0839-da0845 call da05ab 334->344 345 da0847-da086b call da014d 334->345 335->334 341->311 344->345 351 da086f-da0879 call d986ae 344->351 352 da087e-da08c1 345->352 353 da086d 345->353 351->320 354 da08e2-da08f0 352->354 355 da08c3-da08c7 352->355 353->351 358 da097b 354->358 359 da08f6-da08fa 354->359 355->354 357 da08c9-da08dd 355->357 357->354 358->320 359->358 361 da08fc-da092f CloseHandle call da039a 359->361 364 da0963-da0977 361->364 365 da0931-da095d GetLastError call d8f2a3 call d95333 361->365 364->358 365->364
                                                                                            APIs
                                                                                              • Part of subcall function 00DA039A: CreateFileW.KERNEL32(00000000,00000000,?,00DA0704,?,?,00000000,?,00DA0704,00000000,0000000C), ref: 00DA03B7
                                                                                            • GetLastError.KERNEL32 ref: 00DA076F
                                                                                            • __dosmaperr.LIBCMT ref: 00DA0776
                                                                                            • GetFileType.KERNEL32(00000000), ref: 00DA0782
                                                                                            • GetLastError.KERNEL32 ref: 00DA078C
                                                                                            • __dosmaperr.LIBCMT ref: 00DA0795
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DA07B5
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DA08FF
                                                                                            • GetLastError.KERNEL32 ref: 00DA0931
                                                                                            • __dosmaperr.LIBCMT ref: 00DA0938
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                            • String ID: H
                                                                                            • API String ID: 4237864984-2852464175
                                                                                            • Opcode ID: f2d01e5d58fd8e2a531cc29d28344378d680aef65a37b211561e5d6e85eec480
                                                                                            • Instruction ID: 45cdd6b88b0f9657d368c0c6f61a126e363caa975a2b5ec81f7a6c9be13fd622
                                                                                            • Opcode Fuzzy Hash: f2d01e5d58fd8e2a531cc29d28344378d680aef65a37b211561e5d6e85eec480
                                                                                            • Instruction Fuzzy Hash: BFA12432A102088FDF19AF68D855BAE3FA0EB46320F184159F815EB391DB31DC16CBB1
                                                                                            Function 00D6344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                              • Part of subcall function 00D63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E31418,?,00D62E7F,?,?,?,00000000), ref: 00D63A78
                                                                                              • Part of subcall function 00D63357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D63379
                                                                                            • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00D6356A
                                                                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00DA318D
                                                                                            • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00DA31CE
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00DA3210
                                                                                            • _wcslen.LIBCMT ref: 00DA3277
                                                                                            • _wcslen.LIBCMT ref: 00DA3286
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                                            • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                                            • API String ID: 98802146-2727554177
                                                                                            • Opcode ID: c8127b57d3bcdd496ccd6cb65615c9e1cf04d61d92e615983f377e8eba65b4cd
                                                                                            • Instruction ID: e9e96b544ce8dd9b87a4a56d46e77c70e17d0d640dd60ad643a420580955fcee
                                                                                            • Opcode Fuzzy Hash: c8127b57d3bcdd496ccd6cb65615c9e1cf04d61d92e615983f377e8eba65b4cd
                                                                                            • Instruction Fuzzy Hash: 3C71737140430A9FC314EF66EC859ABBBE8FF95750F50442EF685A3160EB749A48CB71
                                                                                            Function 00D62B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00D62B8E
                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00D62B9D
                                                                                            • LoadIconW.USER32(00000063), ref: 00D62BB3
                                                                                            • LoadIconW.USER32(000000A4), ref: 00D62BC5
                                                                                            • LoadIconW.USER32(000000A2), ref: 00D62BD7
                                                                                            • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D62BEF
                                                                                            • RegisterClassExW.USER32(?), ref: 00D62C40
                                                                                              • Part of subcall function 00D62CD4: GetSysColorBrush.USER32(0000000F), ref: 00D62D07
                                                                                              • Part of subcall function 00D62CD4: RegisterClassExW.USER32(00000030), ref: 00D62D31
                                                                                              • Part of subcall function 00D62CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D62D42
                                                                                              • Part of subcall function 00D62CD4: InitCommonControlsEx.COMCTL32(?), ref: 00D62D5F
                                                                                              • Part of subcall function 00D62CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D62D6F
                                                                                              • Part of subcall function 00D62CD4: LoadIconW.USER32(000000A9), ref: 00D62D85
                                                                                              • Part of subcall function 00D62CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D62D94
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                            • String ID: #$0$AutoIt v3
                                                                                            • API String ID: 423443420-4155596026
                                                                                            • Opcode ID: 7970a93556785745842022d3d53839a852a27be91ea13573db3287c451630239
                                                                                            • Instruction ID: 42d074b72ecdf3610aee86ec357ef312ab32021c1f0a6510e7bd98365dc95e85
                                                                                            • Opcode Fuzzy Hash: 7970a93556785745842022d3d53839a852a27be91ea13573db3287c451630239
                                                                                            • Instruction Fuzzy Hash: 63212571A1031CAFDB109FA6ED49BA97FB4FB48B50F11409EE600B67A0D3B10558CFA0
                                                                                            Function 00D63170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 443 d63170-d63185 444 d63187-d6318a 443->444 445 d631e5-d631e7 443->445 447 d6318c-d63193 444->447 448 d631eb 444->448 445->444 446 d631e9 445->446 449 d631d0-d631d8 DefWindowProcW 446->449 452 d63265-d6326d PostQuitMessage 447->452 453 d63199-d6319e 447->453 450 da2dfb-da2e23 call d618e2 call d7e499 448->450 451 d631f1-d631f6 448->451 460 d631de-d631e4 449->460 489 da2e28-da2e2f 450->489 455 d6321d-d63244 SetTimer RegisterWindowMessageW 451->455 456 d631f8-d631fb 451->456 454 d63219-d6321b 452->454 458 d631a4-d631a8 453->458 459 da2e7c-da2e90 call dcbf30 453->459 454->460 455->454 464 d63246-d63251 CreatePopupMenu 455->464 461 da2d9c-da2d9f 456->461 462 d63201-d6320f KillTimer call d630f2 456->462 465 da2e68-da2e77 call dcc161 458->465 466 d631ae-d631b3 458->466 459->454 484 da2e96 459->484 468 da2da1-da2da5 461->468 469 da2dd7-da2df6 MoveWindow 461->469 479 d63214 call d63c50 462->479 464->454 465->454 473 da2e4d-da2e54 466->473 474 d631b9-d631be 466->474 476 da2dc6-da2dd2 SetFocus 468->476 477 da2da7-da2daa 468->477 469->454 473->449 478 da2e5a-da2e63 call dc0ad7 473->478 482 d631c4-d631ca 474->482 483 d63253-d63263 call d6326f 474->483 476->454 477->482 485 da2db0-da2dc1 call d618e2 477->485 478->449 479->454 482->449 482->489 483->454 484->449 485->454 489->449 493 da2e35-da2e48 call d630f2 call d63837 489->493 493->449
                                                                                            APIs
                                                                                            • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00D6316A,?,?), ref: 00D631D8
                                                                                            • KillTimer.USER32(?,00000001,?,?,?,?,?,00D6316A,?,?), ref: 00D63204
                                                                                            • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D63227
                                                                                            • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00D6316A,?,?), ref: 00D63232
                                                                                            • CreatePopupMenu.USER32 ref: 00D63246
                                                                                            • PostQuitMessage.USER32(00000000), ref: 00D63267
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                            • String ID: TaskbarCreated
                                                                                            • API String ID: 129472671-2362178303
                                                                                            • Opcode ID: 41c224684fdc8a73dcd177caf8fd0c6699a42ac838b625398ba155a612ade1ab
                                                                                            • Instruction ID: 111f8e0b1fe40c80ee33dcea5ed00450e7a7ead33ff4691f07a1cd722ebd139e
                                                                                            • Opcode Fuzzy Hash: 41c224684fdc8a73dcd177caf8fd0c6699a42ac838b625398ba155a612ade1ab
                                                                                            • Instruction Fuzzy Hash: CD417731250308ABDB142B789D1EB793E19EB4A340F08416DFA42E62A1CB75CB58C7B5
                                                                                            Function 00D61410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 499 d61410-d61449 500 da24b8-da24b9 DestroyWindow 499->500 501 d6144f-d61465 mciSendStringW 499->501 504 da24c4-da24d1 500->504 502 d616c6-d616d3 501->502 503 d6146b-d61473 501->503 506 d616d5-d616f0 UnregisterHotKey 502->506 507 d616f8-d616ff 502->507 503->504 505 d61479-d61488 call d6182e 503->505 508 da24d3-da24d6 504->508 509 da2500-da2507 504->509 520 da250e-da251a 505->520 521 d6148e-d61496 505->521 506->507 511 d616f2-d616f3 call d610d0 506->511 507->503 512 d61705 507->512 514 da24d8-da24e0 call d66246 508->514 515 da24e2-da24e5 FindClose 508->515 509->504 513 da2509 509->513 511->507 512->502 513->520 519 da24eb-da24f8 514->519 515->519 519->509 525 da24fa-da24fb call dd32b1 519->525 522 da251c-da251e FreeLibrary 520->522 523 da2524-da252b 520->523 526 da2532-da253f 521->526 527 d6149c-d614c1 call d6cfa0 521->527 522->523 523->520 528 da252d 523->528 525->509 529 da2541-da255e VirtualFree 526->529 530 da2566-da256d 526->530 536 d614c3 527->536 537 d614f8-d61503 OleUninitialize 527->537 528->526 529->530 533 da2560-da2561 call dd3317 529->533 530->526 534 da256f 530->534 533->530 540 da2574-da2578 534->540 539 d614c6-d614f6 call d61a05 call d619ae 536->539 537->540 541 d61509-d6150e 537->541 539->537 540->541 545 da257e-da2584 540->545 543 d61514-d6151e 541->543 544 da2589-da2596 call dd32eb 541->544 548 d61707-d61714 call d7f80e 543->548 549 d61524-d615a5 call d6988f call d61944 call d617d5 call d7fe14 call d6177c call d6988f call d6cfa0 call d617fe call d7fe14 543->549 557 da2598 544->557 545->541 548->549 559 d6171a 548->559 561 da259d-da25bf call d7fdcd 549->561 589 d615ab-d615cf call d7fe14 549->589 557->561 559->548 568 da25c1 561->568 571 da25c6-da25e8 call d7fdcd 568->571 577 da25ea 571->577 579 da25ef-da2611 call d7fdcd 577->579 585 da2613 579->585 588 da2618-da2625 call dc64d4 585->588 594 da2627 588->594 589->571 595 d615d5-d615f9 call d7fe14 589->595 598 da262c-da2639 call d7ac64 594->598 595->579 599 d615ff-d61619 call d7fe14 595->599 604 da263b 598->604 599->588 605 d6161f-d61643 call d617d5 call d7fe14 599->605 606 da2640-da264d call dd3245 604->606 605->598 614 d61649-d61651 605->614 612 da264f 606->612 615 da2654-da2661 call dd32cc 612->615 614->606 616 d61657-d61675 call d6988f call d6190a 614->616 621 da2663 615->621 616->615 624 d6167b-d61689 616->624 625 da2668-da2675 call dd32cc 621->625 624->625 626 d6168f-d616c5 call d6988f * 3 call d61876 624->626 631 da2677 625->631 631->631
                                                                                            APIs
                                                                                            • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D61459
                                                                                            • OleUninitialize.OLE32(?,00000000), ref: 00D614F8
                                                                                            • UnregisterHotKey.USER32(?), ref: 00D616DD
                                                                                            • DestroyWindow.USER32(?), ref: 00DA24B9
                                                                                            • FreeLibrary.KERNEL32(?), ref: 00DA251E
                                                                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DA254B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                            • String ID: close all
                                                                                            • API String ID: 469580280-3243417748
                                                                                            • Opcode ID: 1e3fb98162c366339eab1147c9c585e1594e7f6bea509bf78caaee7badf40a05
                                                                                            • Instruction ID: 1d108078d7cfa36bf36dcaa95e31cb9ef9f8475e29f56fba77be4bb499a87532
                                                                                            • Opcode Fuzzy Hash: 1e3fb98162c366339eab1147c9c585e1594e7f6bea509bf78caaee7badf40a05
                                                                                            • Instruction Fuzzy Hash: 24D14A357022128FCB29EF59C995A29F7A4FF05700F1981ADE44AAB251DB30ED26CF71
                                                                                            Function 00D62C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 648 d62c63-d62cd3 CreateWindowExW * 2 ShowWindow * 2
                                                                                            APIs
                                                                                            • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D62C91
                                                                                            • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D62CB2
                                                                                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00D61CAD,?), ref: 00D62CC6
                                                                                            • ShowWindow.USER32(00000000,?,?,?,?,?,?,00D61CAD,?), ref: 00D62CCF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$CreateShow
                                                                                            • String ID: AutoIt v3$edit
                                                                                            • API String ID: 1584632944-3779509399
                                                                                            • Opcode ID: 74dcdb3a975cc34e7835f57e0b01e220867a26d735a69d4361f2289afa55f49b
                                                                                            • Instruction ID: a581b9b3556e358aa65d49d70fe3a411c02428c3c75a5ac931f4b1cf715e4052
                                                                                            • Opcode Fuzzy Hash: 74dcdb3a975cc34e7835f57e0b01e220867a26d735a69d4361f2289afa55f49b
                                                                                            • Instruction Fuzzy Hash: E9F0B77555029C7EEB211717AC0CFBB6EBDD7C6F50B02509EFA00A76A0C6611858DEB0
                                                                                            Function 00DEAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 763 dead64-dead9c call d6a961 call d82340 768 dead9e-deadb5 call d67510 763->768 769 deadd1-deadd5 763->769 768->769 778 deadb7-deadce call d67510 call d67620 768->778 771 deadd7-deadee call d67510 call d67620 769->771 772 deadf1-deadf5 769->772 771->772 773 deae3a 772->773 774 deadf7-deae0e call d67510 772->774 779 deae3c-deae40 773->779 774->779 789 deae10-deae21 call d69b47 774->789 778->769 781 deae42-deae50 call d6b567 779->781 782 deae53-deaeae call d82340 call d67510 ShellExecuteExW 779->782 781->782 800 deaeb7-deaeb9 782->800 801 deaeb0-deaeb6 call d7fe14 782->801 789->773 799 deae23-deae2e call d67510 789->799 799->773 810 deae30-deae35 call d6a8c7 799->810 805 deaebb-deaec1 call d7fe14 800->805 806 deaec2-deaec6 800->806 801->800 805->806 807 deaf0a-deaf0e 806->807 808 deaec8-deaed6 806->808 814 deaf1b-deaf33 call d6cfa0 807->814 815 deaf10-deaf19 807->815 812 deaedb-deaeeb 808->812 813 deaed8 808->813 810->773 818 deaeed 812->818 819 deaef0-deaf08 call d6cfa0 812->819 813->812 820 deaf6d-deaf7b call d6988f 814->820 827 deaf35-deaf46 GetProcessId 814->827 815->820 818->819 819->820 828 deaf4e-deaf67 call d6cfa0 CloseHandle 827->828 829 deaf48 827->829 828->820 829->828
                                                                                            APIs
                                                                                            • ShellExecuteExW.SHELL32(0000003C), ref: 00DEAEA3
                                                                                              • Part of subcall function 00D67620: _wcslen.LIBCMT ref: 00D67625
                                                                                            • GetProcessId.KERNEL32(00000000), ref: 00DEAF38
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEAF67
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                                            • String ID: <$@
                                                                                            • API String ID: 146682121-1426351568
                                                                                            • Opcode ID: 808f531e4b1aa6e08f5822e45880a9b62a79932836d0239f4fddb0c3cd130717
                                                                                            • Instruction ID: 0e010d606ca456130521a5ff9498e6ff37e168789710060e95e6a310e5628577
                                                                                            • Opcode Fuzzy Hash: 808f531e4b1aa6e08f5822e45880a9b62a79932836d0239f4fddb0c3cd130717
                                                                                            • Instruction Fuzzy Hash: BE714770A00259DFCB14EF99C494A9EBBF0EF08314F048499E856AB392D774ED45CBB1
                                                                                            Function 00D63B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1142 d63b1c-d63b27 1143 d63b99-d63b9b 1142->1143 1144 d63b29-d63b2e 1142->1144 1145 d63b8c-d63b8f 1143->1145 1144->1143 1146 d63b30-d63b48 RegOpenKeyExW 1144->1146 1146->1143 1147 d63b4a-d63b69 RegQueryValueExW 1146->1147 1148 d63b80-d63b8b RegCloseKey 1147->1148 1149 d63b6b-d63b76 1147->1149 1148->1145 1150 d63b90-d63b97 1149->1150 1151 d63b78-d63b7a 1149->1151 1152 d63b7e 1150->1152 1151->1152 1152->1148
                                                                                            APIs
                                                                                            • RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00D63B0F,SwapMouseButtons,00000004,?), ref: 00D63B40
                                                                                            • RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00D63B0F,SwapMouseButtons,00000004,?), ref: 00D63B61
                                                                                            • RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00D63B0F,SwapMouseButtons,00000004,?), ref: 00D63B83
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseOpenQueryValue
                                                                                            • String ID: Control Panel\Mouse
                                                                                            • API String ID: 3677997916-824357125
                                                                                            • Opcode ID: 58a6c0ac2303576f4a4a7eba706519014d8cc280b81e7562219f75cd669cb0f6
                                                                                            • Instruction ID: e3b7f2071222a3ca6b165258c939239402f6568e1b7c6eaa3340806b8ed24e75
                                                                                            • Opcode Fuzzy Hash: 58a6c0ac2303576f4a4a7eba706519014d8cc280b81e7562219f75cd669cb0f6
                                                                                            • Instruction Fuzzy Hash: 0E115AB1520208FFDB208FA8DC44EEEB7B8EF01740B108459A805D7210D6319E409770
                                                                                            Function 00D63923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DA33A2
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D63A04
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconLoadNotifyShell_String_wcslen
                                                                                            • String ID: Line:
                                                                                            • API String ID: 2289894680-1585850449
                                                                                            • Opcode ID: a72dc3c27d0bf7441338c79d9c1b27b04dedc5fe562b9582788470695e86d154
                                                                                            • Instruction ID: 0321ab1c9deb944367c71e3700cb5a54856a30be962c19601fa1520b790b430d
                                                                                            • Opcode Fuzzy Hash: a72dc3c27d0bf7441338c79d9c1b27b04dedc5fe562b9582788470695e86d154
                                                                                            • Instruction Fuzzy Hash: 5231AD71408304ABC721EB24DC49BEBB7E8EF44710F04496EF59992191EB709A48CBF2
                                                                                            Function 00D62DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetOpenFileNameW.COMDLG32(?), ref: 00DA2C8C
                                                                                              • Part of subcall function 00D63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D63A97,?,?,00D62E7F,?,?,?,00000000), ref: 00D63AC2
                                                                                              • Part of subcall function 00D62DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00D62DC4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Name$Path$FileFullLongOpen
                                                                                            • String ID: X$`e
                                                                                            • API String ID: 779396738-4036142377
                                                                                            • Opcode ID: 310af6f78716aff81720efe723292132ae0d6627b21764f9cabbf0b10b3b67c4
                                                                                            • Instruction ID: 1a2f6e4e2dbda39db950a21aed685770286c643b65d9ff56e177931097d0cbd4
                                                                                            • Opcode Fuzzy Hash: 310af6f78716aff81720efe723292132ae0d6627b21764f9cabbf0b10b3b67c4
                                                                                            • Instruction Fuzzy Hash: 8021A271A002989FCB01EF98D846BEE7BF8EF49314F008059E445F7241DBB49A898FB1
                                                                                            Function 00D7FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00D80668
                                                                                              • Part of subcall function 00D832A4: RaiseException.KERNEL32(?,?,?,00D8068A,?,00E31444,?,?,?,?,?,?,00D8068A,00D61129,00E28738,00D61129), ref: 00D83304
                                                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 00D80685
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Exception@8Throw$ExceptionRaise
                                                                                            • String ID: Unknown exception
                                                                                            • API String ID: 3476068407-410509341
                                                                                            • Opcode ID: 0bf59717c712e4d96d56336f5ea550594fc06e219ff341539b6fbb23cf9a51cc
                                                                                            • Instruction ID: 28f201cf06682e4c549914d9c993a6a57667779f23e72c669fe5173606396c7d
                                                                                            • Opcode Fuzzy Hash: 0bf59717c712e4d96d56336f5ea550594fc06e219ff341539b6fbb23cf9a51cc
                                                                                            • Instruction Fuzzy Hash: 63F0C23490030DB78B20B764E846DAE7B6C9E00710B648575B928D6591FF71DA29CBB0
                                                                                            Function 00D610F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D61BF4
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D61BFC
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D61C07
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D61C12
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D61C1A
                                                                                              • Part of subcall function 00D61BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D61C22
                                                                                              • Part of subcall function 00D61B4A: RegisterWindowMessageW.USER32(00000004,?,00D612C4), ref: 00D61BA2
                                                                                            • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D6136A
                                                                                            • OleInitialize.OLE32 ref: 00D61388
                                                                                            • CloseHandle.KERNEL32(00000000,00000000), ref: 00DA24AB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1986988660-0
                                                                                            • Opcode ID: 8a412206b3e06964ab8929f2e0bedcde0b6340da6f6f845ec1de0ad9051ea528
                                                                                            • Instruction ID: 80226356bc42cb64b20db62f8840914ea7ed79c952cb3471ac3eccb72f640f2d
                                                                                            • Opcode Fuzzy Hash: 8a412206b3e06964ab8929f2e0bedcde0b6340da6f6f845ec1de0ad9051ea528
                                                                                            • Instruction Fuzzy Hash: F671CCB4911308AFC388DF7BA94E6653EE0FB8934175992AED05AF7361EB304409CF65
                                                                                            Function 00D986AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,00D985CC,?,00E28CC8,0000000C), ref: 00D98704
                                                                                            • GetLastError.KERNEL32(?,00D985CC,?,00E28CC8,0000000C), ref: 00D9870E
                                                                                            • __dosmaperr.LIBCMT ref: 00D98739
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                                                                                            • String ID:
                                                                                            • API String ID: 490808831-0
                                                                                            • Opcode ID: 5e4b73f08b55f5f0390d4f641910cb4ac190ab9765cc9be3f11387cbebef3972
                                                                                            • Instruction ID: 2072595a2fcc6fac63fb6c033b35d0c2fad866c3d6cad9bd9d7d554c34bfe917
                                                                                            • Opcode Fuzzy Hash: 5e4b73f08b55f5f0390d4f641910cb4ac190ab9765cc9be3f11387cbebef3972
                                                                                            • Instruction Fuzzy Hash: D90108336056202ADF257374A845B7E6B598B83F74F2D0129E914DF1D2DEA0CC81E2B0
                                                                                            Function 00D71310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __Init_thread_footer.LIBCMT ref: 00D717F6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Init_thread_footer
                                                                                            • String ID: CALL
                                                                                            • API String ID: 1385522511-4196123274
                                                                                            • Opcode ID: c411adb51231f04f691594b48c449dce989f58a1101fd02c7fd21114b3a27f4f
                                                                                            • Instruction ID: d7e3b75abe14aa986efe09cf9259a5b06331354865c718b1025deafb2666d34a
                                                                                            • Opcode Fuzzy Hash: c411adb51231f04f691594b48c449dce989f58a1101fd02c7fd21114b3a27f4f
                                                                                            • Instruction Fuzzy Hash: 3A227974608241DFC724DF18C480A6ABBF1FF85314F188A1DF49A8B361E735E945CBA2
                                                                                            Function 00D63837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D63908
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconNotifyShell_
                                                                                            • String ID:
                                                                                            • API String ID: 1144537725-0
                                                                                            • Opcode ID: f7e0cc48fae19e0df0b452fcd2e36a6e3f6612c94d5c2433a6bf87afaed24efd
                                                                                            • Instruction ID: f09fcab46b66c5c18a2ac7609a521493e1f78d8dde81aa24ae273989cd6c98d8
                                                                                            • Opcode Fuzzy Hash: f7e0cc48fae19e0df0b452fcd2e36a6e3f6612c94d5c2433a6bf87afaed24efd
                                                                                            • Instruction Fuzzy Hash: EB3191706047059FD720DF25D8847EBBBE8FB49708F04096EF59A93240E771AA48CB72
                                                                                            Function 00D64ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D64E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D64EDD,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E9C
                                                                                              • Part of subcall function 00D64E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D64EAE
                                                                                              • Part of subcall function 00D64E90: FreeLibrary.KERNEL32(00000000,?,?,00D64EDD,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64EC0
                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64EFD
                                                                                              • Part of subcall function 00D64E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DA3CDE,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E62
                                                                                              • Part of subcall function 00D64E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D64E74
                                                                                              • Part of subcall function 00D64E59: FreeLibrary.KERNEL32(00000000,?,?,00DA3CDE,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E87
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$Load$AddressFreeProc
                                                                                            • String ID:
                                                                                            • API String ID: 2632591731-0
                                                                                            • Opcode ID: 34d6a04a7a45387e62debc7a0e5efadb1b3dc96376e8521c9ffc0880cead0f2d
                                                                                            • Instruction ID: 8d743c2682ece0b37c816e2373f7f2c095de1ea7de5aa08b8ac5b81086821bd7
                                                                                            • Opcode Fuzzy Hash: 34d6a04a7a45387e62debc7a0e5efadb1b3dc96376e8521c9ffc0880cead0f2d
                                                                                            • Instruction Fuzzy Hash: 4A11E332610305ABCB15FB64DC12FAD77A5EF50710F20842EF542A61C2EE71DA459BB0
                                                                                            Function 00D98402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: __wsopen_s
                                                                                            • String ID:
                                                                                            • API String ID: 3347428461-0
                                                                                            • Opcode ID: 4705f1bbe589037f3bc721adb6e4b69704cd2f937665229f55e20db613aeeda2
                                                                                            • Instruction ID: be47c8f4448de06938a1896aa1889ba7cc048e97917f376abaddc04e346e1ef7
                                                                                            • Opcode Fuzzy Hash: 4705f1bbe589037f3bc721adb6e4b69704cd2f937665229f55e20db613aeeda2
                                                                                            • Instruction Fuzzy Hash: 3511487190420AAFCF05DF58E94099ABBF5EF49300F144069F808AB312DA31DA11DBA4
                                                                                            Function 00D95000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D94C7D: RtlAllocateHeap.NTDLL(00000008,00D61129,00000000,?,00D92E29,00000001,00000364,?,?,?,00D8F2DE,00D93863,00E31444,?,00D7FDF5,?), ref: 00D94CBE
                                                                                            • _free.LIBCMT ref: 00D9506C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap_free
                                                                                            • String ID:
                                                                                            • API String ID: 614378929-0
                                                                                            • Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                            • Instruction ID: a23fafc7bd0ada18466fe7344915b08e56ad97e28e66d6801bfce1182830f7a1
                                                                                            • Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
                                                                                            • Instruction Fuzzy Hash: 3A014E722047056BE732CF55D84195AFBECFB85370F25062DE188832C0E730A805C7B4
                                                                                            Function 00D8E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                            • Instruction ID: 38e6ad6e3c68e789033b67b651109aa675d1d9aa368a8a4f2e6270282e7c34a2
                                                                                            • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                                            • Instruction Fuzzy Hash: EEF02832511A14A6DB313B698C06B5A339CDF52330F180B15F424D31E2EB70D8028FB5
                                                                                            Function 00D94C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RtlAllocateHeap.NTDLL(00000008,00D61129,00000000,?,00D92E29,00000001,00000364,?,?,?,00D8F2DE,00D93863,00E31444,?,00D7FDF5,?), ref: 00D94CBE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 1279760036-0
                                                                                            • Opcode ID: e58f5b07a1ad9a64410d2f7bc0c5418fc6430c5e45689376d752116224ca0023
                                                                                            • Instruction ID: e54349469a7028268d728332297cf2737d17165b76363f42daad4ca7b65e9bd0
                                                                                            • Opcode Fuzzy Hash: e58f5b07a1ad9a64410d2f7bc0c5418fc6430c5e45689376d752116224ca0023
                                                                                            • Instruction Fuzzy Hash: B9F0E9316032246FDF217F629D09F5A3788FF917A1B194215B815E6282CF30D81286F0
                                                                                            Function 00D93820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6,?,00D61129), ref: 00D93852
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 1279760036-0
                                                                                            • Opcode ID: 9e10b4fe7bc8626a0c3bd493fd2ce75d2ceff6c8df8bfecca89207e2746dd564
                                                                                            • Instruction ID: bbf840be25886c44b8b85b0959d5dbca23c5af19da24a85e6dd59a8ca0e7c146
                                                                                            • Opcode Fuzzy Hash: 9e10b4fe7bc8626a0c3bd493fd2ce75d2ceff6c8df8bfecca89207e2746dd564
                                                                                            • Instruction Fuzzy Hash: 99E0E53110132956DF2136A79C04B9A3649EF427B0F090065BC45D2980CB10DD0192F0
                                                                                            Function 00D64F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FreeLibrary.KERNEL32(?,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64F6D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeLibrary
                                                                                            • String ID:
                                                                                            • API String ID: 3664257935-0
                                                                                            • Opcode ID: adcc5db5662b87ba48265bb2a35aecde5131f27abd5c508768b9e74f7e465316
                                                                                            • Instruction ID: 5ed665e388375fbcec686859d02b5e794802c76400a5cb89ed9a96bb9780590d
                                                                                            • Opcode Fuzzy Hash: adcc5db5662b87ba48265bb2a35aecde5131f27abd5c508768b9e74f7e465316
                                                                                            • Instruction Fuzzy Hash: C3F0C071509751CFDB389F64D494826B7E5EF14329314897EE1DA82611C7319854DF60
                                                                                            Function 00D630F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00D6314E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconNotifyShell_
                                                                                            • String ID:
                                                                                            • API String ID: 1144537725-0
                                                                                            • Opcode ID: f1e0dfc21a4cb8977dc11cc96594336037fb83853400a61e30db0ee6f1957f69
                                                                                            • Instruction ID: 5b418f429eebc6deffde66d9677b3778cbcfab26fbfe059ca36b9afdf05b1329
                                                                                            • Opcode Fuzzy Hash: f1e0dfc21a4cb8977dc11cc96594336037fb83853400a61e30db0ee6f1957f69
                                                                                            • Instruction Fuzzy Hash: 34F037709143189FE7529B24DC497E97BFCA701708F0400E9A588A7291D774578CCF51
                                                                                            Function 00D62DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00D62DC4
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LongNamePath_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 541455249-0
                                                                                            • Opcode ID: 9e0211efe769dd7c20f90f46bed0b8c63b255dfa1fb317ee3cf7aa6ab2aded75
                                                                                            • Instruction ID: 6db1eee093bbb33b539b8faee9af0646f861358b64263aa33c96aa5d09fc780a
                                                                                            • Opcode Fuzzy Hash: 9e0211efe769dd7c20f90f46bed0b8c63b255dfa1fb317ee3cf7aa6ab2aded75
                                                                                            • Instruction Fuzzy Hash: D0E0CD766042245BC710965C9C05FEA77DDDFC8790F044071FD09D7248D960ED80C570
                                                                                            Function 00D62B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D63837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D63908
                                                                                              • Part of subcall function 00D6D730: GetInputState.USER32 ref: 00D6D807
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00D62B6B
                                                                                              • Part of subcall function 00D630F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00D6314E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                                                            • String ID:
                                                                                            • API String ID: 3667716007-0
                                                                                            • Opcode ID: bfd63ef3e0ca14fbd51039eaa9fd01aaa1b0de11d6d89fb695c6a65c22f714a1
                                                                                            • Instruction ID: 756d38941f80888e129cca2d0dbec997b29ae6eab874e6d7b835067b78ad1985
                                                                                            • Opcode Fuzzy Hash: bfd63ef3e0ca14fbd51039eaa9fd01aaa1b0de11d6d89fb695c6a65c22f714a1
                                                                                            • Instruction Fuzzy Hash: A2E0863170428807C608BB75A8565BDF759DBE1351F40157EF552932A2CE2449598272
                                                                                            Function 00DA039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(00000000,00000000,?,00DA0704,?,?,00000000,?,00DA0704,00000000,0000000C), ref: 00DA03B7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFile
                                                                                            • String ID:
                                                                                            • API String ID: 823142352-0
                                                                                            • Opcode ID: 2dc810bf4f1873209705941e0370edb19e03709ffe2de1110366af641f521532
                                                                                            • Instruction ID: 02dc0884c0936e9cfeaaa91014256e88017dc7a2ad29934de08fdbdc36d337c5
                                                                                            • Opcode Fuzzy Hash: 2dc810bf4f1873209705941e0370edb19e03709ffe2de1110366af641f521532
                                                                                            • Instruction Fuzzy Hash: 34D06C3205020DBBDF028F84DD06EDA3BAAFB48714F018000BE1896120C732E831EB90
                                                                                            Function 00D61CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00D61CBC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: InfoParametersSystem
                                                                                            • String ID:
                                                                                            • API String ID: 3098949447-0
                                                                                            • Opcode ID: ad5a9c7f1c7c39742aff745ccd800e175da59bfd1debd59e793d7244e5ef97a3
                                                                                            • Instruction ID: 47f5d011260f8b0e6147f02e9df6798c4ebf2e6c6354dd78d5e67281db6be202
                                                                                            • Opcode Fuzzy Hash: ad5a9c7f1c7c39742aff745ccd800e175da59bfd1debd59e793d7244e5ef97a3
                                                                                            • Instruction Fuzzy Hash: F2C09B3528030CAFF2144781BD4EF107B64A348B01F048005F749B56E3C3A11428D651

                                                                                            Non-executed Functions

                                                                                            Function 00DF9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00DF961A
                                                                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DF965B
                                                                                            • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00DF969F
                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DF96C9
                                                                                            • SendMessageW.USER32 ref: 00DF96F2
                                                                                            • GetKeyState.USER32(00000011), ref: 00DF978B
                                                                                            • GetKeyState.USER32(00000009), ref: 00DF9798
                                                                                            • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DF97AE
                                                                                            • GetKeyState.USER32(00000010), ref: 00DF97B8
                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DF97E9
                                                                                            • SendMessageW.USER32 ref: 00DF9810
                                                                                            • SendMessageW.USER32(?,00001030,?,00DF7E95), ref: 00DF9918
                                                                                            • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00DF992E
                                                                                            • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00DF9941
                                                                                            • SetCapture.USER32(?), ref: 00DF994A
                                                                                            • ClientToScreen.USER32(?,?), ref: 00DF99AF
                                                                                            • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00DF99BC
                                                                                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00DF99D6
                                                                                            • ReleaseCapture.USER32 ref: 00DF99E1
                                                                                            • GetCursorPos.USER32(?), ref: 00DF9A19
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF9A26
                                                                                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 00DF9A80
                                                                                            • SendMessageW.USER32 ref: 00DF9AAE
                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00DF9AEB
                                                                                            • SendMessageW.USER32 ref: 00DF9B1A
                                                                                            • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00DF9B3B
                                                                                            • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00DF9B4A
                                                                                            • GetCursorPos.USER32(?), ref: 00DF9B68
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF9B75
                                                                                            • GetParent.USER32(?), ref: 00DF9B93
                                                                                            • SendMessageW.USER32(?,00001012,00000000,?), ref: 00DF9BFA
                                                                                            • SendMessageW.USER32 ref: 00DF9C2B
                                                                                            • ClientToScreen.USER32(?,?), ref: 00DF9C84
                                                                                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00DF9CB4
                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00DF9CDE
                                                                                            • SendMessageW.USER32 ref: 00DF9D01
                                                                                            • ClientToScreen.USER32(?,?), ref: 00DF9D4E
                                                                                            • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00DF9D82
                                                                                              • Part of subcall function 00D79944: GetWindowLongW.USER32(?,000000EB), ref: 00D79952
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF9E05
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                                            • String ID: @GUI_DRAGID$F$p#
                                                                                            • API String ID: 3429851547-638943876
                                                                                            • Opcode ID: 98c25505c5f09453e4ee1eeb5f5d59b65ef06b1371a3ed3d2744e725b940a641
                                                                                            • Instruction ID: 9f2b6a2bcd54aafeecfdd1a6ddb57d2ee8c58e14c1c760d02a86a0bfd0703206
                                                                                            • Opcode Fuzzy Hash: 98c25505c5f09453e4ee1eeb5f5d59b65ef06b1371a3ed3d2744e725b940a641
                                                                                            • Instruction Fuzzy Hash: 17427C30A04309AFD724CF28CC54BBABBE5EF88714F168619F699D72A1D731D864CB61
                                                                                            Function 00DF4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00DF48F3
                                                                                            • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00DF4908
                                                                                            • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00DF4927
                                                                                            • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00DF494B
                                                                                            • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00DF495C
                                                                                            • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00DF497B
                                                                                            • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00DF49AE
                                                                                            • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00DF49D4
                                                                                            • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00DF4A0F
                                                                                            • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00DF4A56
                                                                                            • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00DF4A7E
                                                                                            • IsMenu.USER32(?), ref: 00DF4A97
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DF4AF2
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DF4B20
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF4B94
                                                                                            • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00DF4BE3
                                                                                            • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00DF4C82
                                                                                            • wsprintfW.USER32 ref: 00DF4CAE
                                                                                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DF4CC9
                                                                                            • GetWindowTextW.USER32(?,00000000,00000001), ref: 00DF4CF1
                                                                                            • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00DF4D13
                                                                                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DF4D33
                                                                                            • GetWindowTextW.USER32(?,00000000,00000001), ref: 00DF4D5A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                                                            • String ID: %d/%02d/%02d
                                                                                            • API String ID: 4054740463-328681919
                                                                                            • Opcode ID: d619194e724e9f6b359d5ec9c9589500e574b771a99171191f1b96c6fe47a2b0
                                                                                            • Instruction ID: 35936ae1fd54f5c5341adac8a19c6a3aec5f103a02dc60d0ac15e0cc0cc44b18
                                                                                            • Opcode Fuzzy Hash: d619194e724e9f6b359d5ec9c9589500e574b771a99171191f1b96c6fe47a2b0
                                                                                            • Instruction Fuzzy Hash: 3012DF71600258ABEB248F28DC49FBF7BB8EF45314F158119FA59EA2A1DB74D940CB70
                                                                                            Function 00D7F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00D7F998
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DBF474
                                                                                            • IsIconic.USER32(00000000), ref: 00DBF47D
                                                                                            • ShowWindow.USER32(00000000,00000009), ref: 00DBF48A
                                                                                            • SetForegroundWindow.USER32(00000000), ref: 00DBF494
                                                                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DBF4AA
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00DBF4B1
                                                                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DBF4BD
                                                                                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 00DBF4CE
                                                                                            • AttachThreadInput.USER32(?,00000000,00000001), ref: 00DBF4D6
                                                                                            • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00DBF4DE
                                                                                            • SetForegroundWindow.USER32(00000000), ref: 00DBF4E1
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBF4F6
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 00DBF501
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBF50B
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 00DBF510
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBF519
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 00DBF51E
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00DBF528
                                                                                            • keybd_event.USER32(00000012,00000000), ref: 00DBF52D
                                                                                            • SetForegroundWindow.USER32(00000000), ref: 00DBF530
                                                                                            • AttachThreadInput.USER32(?,000000FF,00000000), ref: 00DBF557
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 4125248594-2988720461
                                                                                            • Opcode ID: dca3f28c2c99d625418dfcef65d986976b810836eb0c6f27fc4b839f7b0a1363
                                                                                            • Instruction ID: 41582ca62285005653186c300daf493593ff2c33f6a89330ce817003bfd8636a
                                                                                            • Opcode Fuzzy Hash: dca3f28c2c99d625418dfcef65d986976b810836eb0c6f27fc4b839f7b0a1363
                                                                                            • Instruction Fuzzy Hash: 58315071A5031CBBEB206BB59D4AFBF7EACEB44B50F145065FA01E62D1C6B09D10EA70
                                                                                            Function 00DC1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DC170D
                                                                                              • Part of subcall function 00DC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DC173A
                                                                                              • Part of subcall function 00DC16C3: GetLastError.KERNEL32 ref: 00DC174A
                                                                                            • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00DC1286
                                                                                            • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00DC12A8
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DC12B9
                                                                                            • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00DC12D1
                                                                                            • GetProcessWindowStation.USER32 ref: 00DC12EA
                                                                                            • SetProcessWindowStation.USER32(00000000), ref: 00DC12F4
                                                                                            • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00DC1310
                                                                                              • Part of subcall function 00DC10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DC11FC), ref: 00DC10D4
                                                                                              • Part of subcall function 00DC10BF: CloseHandle.KERNEL32(?,?,00DC11FC), ref: 00DC10E9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                                            • String ID: $default$winsta0$Z
                                                                                            • API String ID: 22674027-1808616255
                                                                                            • Opcode ID: a45be9b8d0bfc812b6d469da8a691682eebdb9399d72f0cce2deba10dcbdbb95
                                                                                            • Instruction ID: f74a1254ecef32eaf0cefdf56d5dea8779461d1e14e8926bcbfac96f96250d1b
                                                                                            • Opcode Fuzzy Hash: a45be9b8d0bfc812b6d469da8a691682eebdb9399d72f0cce2deba10dcbdbb95
                                                                                            • Instruction Fuzzy Hash: 8281867590431AABDF259FA4DD49FEE7BB9EF05700F188169F910E62A2D7308A54CB30
                                                                                            Function 00DC0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DC1114
                                                                                              • Part of subcall function 00DC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1120
                                                                                              • Part of subcall function 00DC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC112F
                                                                                              • Part of subcall function 00DC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1136
                                                                                              • Part of subcall function 00DC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DC114D
                                                                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DC0BCC
                                                                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DC0C00
                                                                                            • GetLengthSid.ADVAPI32(?), ref: 00DC0C17
                                                                                            • GetAce.ADVAPI32(?,00000000,?), ref: 00DC0C51
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DC0C6D
                                                                                            • GetLengthSid.ADVAPI32(?), ref: 00DC0C84
                                                                                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DC0C8C
                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00DC0C93
                                                                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DC0CB4
                                                                                            • CopySid.ADVAPI32(00000000), ref: 00DC0CBB
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DC0CEA
                                                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DC0D0C
                                                                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DC0D1E
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0D45
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0D4C
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0D55
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0D5C
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0D65
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0D6C
                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00DC0D78
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0D7F
                                                                                              • Part of subcall function 00DC1193: GetProcessHeap.KERNEL32(00000008,00DC0BB1,?,00000000,?,00DC0BB1,?), ref: 00DC11A1
                                                                                              • Part of subcall function 00DC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DC0BB1,?), ref: 00DC11A8
                                                                                              • Part of subcall function 00DC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DC0BB1,?), ref: 00DC11B7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                            • String ID:
                                                                                            • API String ID: 4175595110-0
                                                                                            • Opcode ID: de431ea1996db8f8421d6baaab1b9d2c078b380e3fa643f99515a31b13ee51c2
                                                                                            • Instruction ID: 1b7e57e719bdd509786c8a67fcf4c800dcb3a9611348ebbda8577e4f2b0d986b
                                                                                            • Opcode Fuzzy Hash: de431ea1996db8f8421d6baaab1b9d2c078b380e3fa643f99515a31b13ee51c2
                                                                                            • Instruction Fuzzy Hash: 99714A76A0020AEBDF109FA4DD44FEEBBBCAF04700F088619E915E7291D771AA15CB70
                                                                                            Function 00DDEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • OpenClipboard.USER32(00DFCC08), ref: 00DDEB29
                                                                                            • IsClipboardFormatAvailable.USER32(0000000D), ref: 00DDEB37
                                                                                            • GetClipboardData.USER32(0000000D), ref: 00DDEB43
                                                                                            • CloseClipboard.USER32 ref: 00DDEB4F
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00DDEB87
                                                                                            • CloseClipboard.USER32 ref: 00DDEB91
                                                                                            • GlobalUnlock.KERNEL32(00000000,00000000), ref: 00DDEBBC
                                                                                            • IsClipboardFormatAvailable.USER32(00000001), ref: 00DDEBC9
                                                                                            • GetClipboardData.USER32(00000001), ref: 00DDEBD1
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00DDEBE2
                                                                                            • GlobalUnlock.KERNEL32(00000000,?), ref: 00DDEC22
                                                                                            • IsClipboardFormatAvailable.USER32(0000000F), ref: 00DDEC38
                                                                                            • GetClipboardData.USER32(0000000F), ref: 00DDEC44
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00DDEC55
                                                                                            • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00DDEC77
                                                                                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DDEC94
                                                                                            • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DDECD2
                                                                                            • GlobalUnlock.KERNEL32(00000000,?,?), ref: 00DDECF3
                                                                                            • CountClipboardFormats.USER32 ref: 00DDED14
                                                                                            • CloseClipboard.USER32 ref: 00DDED59
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                                            • String ID:
                                                                                            • API String ID: 420908878-0
                                                                                            • Opcode ID: dc2bed61d1e689090dd9290fc5a3f8e3d91c56f41ed992199e7b1c1b69d32bf6
                                                                                            • Instruction ID: c22691c8d75d51c79d5fc5f6ede00fde1c85d33a68f4ec73c7d168497ded6c3b
                                                                                            • Opcode Fuzzy Hash: dc2bed61d1e689090dd9290fc5a3f8e3d91c56f41ed992199e7b1c1b69d32bf6
                                                                                            • Instruction Fuzzy Hash: B3618A342043059FD300EF24D994F7AB7A8EB84704F18951AF496DB3A2DB71E909CBB2
                                                                                            Function 00DD698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DD69BE
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD6A12
                                                                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DD6A4E
                                                                                            • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DD6A75
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 00DD6AB2
                                                                                            • FileTimeToSystemTime.KERNEL32(?,?), ref: 00DD6ADF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                                            • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                                            • API String ID: 3830820486-3289030164
                                                                                            • Opcode ID: dfe5cbd6ea4f6e6bb9de4f2d068d218d983ad9ceacce85e1ab5e0bf21a14201a
                                                                                            • Instruction ID: 9aa620dcb0ef2d03f54238ae0fc3f6e7db0334a2f453206f3b5dcd4df663bf6c
                                                                                            • Opcode Fuzzy Hash: dfe5cbd6ea4f6e6bb9de4f2d068d218d983ad9ceacce85e1ab5e0bf21a14201a
                                                                                            • Instruction Fuzzy Hash: 33D13E71508344AFC310EBA4C991EABB7ECEF98704F04491EF589D6291EB74DA44CBB2
                                                                                            Function 00DD9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DD9663
                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00DD96A1
                                                                                            • SetFileAttributesW.KERNEL32(?,?), ref: 00DD96BB
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00DD96D3
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD96DE
                                                                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 00DD96FA
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD974A
                                                                                            • SetCurrentDirectoryW.KERNEL32(00E26B7C), ref: 00DD9768
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DD9772
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD977F
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD978F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1409584000-438819550
                                                                                            • Opcode ID: d21771a4fa8686af81e625c3ff9cbfcefa728cc9d82116fc9d493ff3ebcdfea9
                                                                                            • Instruction ID: 87839f41e27cfd010f588e6f5279e377c95b5c8097b5650e19fbd0c9f28bccbb
                                                                                            • Opcode Fuzzy Hash: d21771a4fa8686af81e625c3ff9cbfcefa728cc9d82116fc9d493ff3ebcdfea9
                                                                                            • Instruction Fuzzy Hash: 6B31BF3254021D7ADF14AFB4ED18AEEB7ACEF09321F188156F805E22A0DB31DA54CB34
                                                                                            Function 00DD979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DD97BE
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00DD9819
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD9824
                                                                                            • FindFirstFileW.KERNEL32(*.*,?), ref: 00DD9840
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD9890
                                                                                            • SetCurrentDirectoryW.KERNEL32(00E26B7C), ref: 00DD98AE
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DD98B8
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD98C5
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD98D5
                                                                                              • Part of subcall function 00DCDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00DCDB00
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                            • String ID: *.*
                                                                                            • API String ID: 2640511053-438819550
                                                                                            • Opcode ID: 75bd774fda1ebf5ba6656c58cf602bec779a43f43ca4d8a48d19fb6ef4e9b618
                                                                                            • Instruction ID: ae36b58b2dce06538684e6edf5fb88aabd7c71b4ca91b953a5aca6ae840a3f2f
                                                                                            • Opcode Fuzzy Hash: 75bd774fda1ebf5ba6656c58cf602bec779a43f43ca4d8a48d19fb6ef4e9b618
                                                                                            • Instruction Fuzzy Hash: CD31C33254021D6EDF10AFB4EC58AEEB7ACDF06720F188156E810E62A0DB32DA55DB74
                                                                                            Function 00DEBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DEB6AE,?,?), ref: 00DEC9B5
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DEC9F1
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA68
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA9E
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DEBF3E
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00DEBFA9
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEBFCD
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00DEC02C
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00DEC0E7
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00DEC154
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00DEC1E9
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00DEC23A
                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00DEC2E3
                                                                                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00DEC382
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEC38F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                                            • String ID:
                                                                                            • API String ID: 3102970594-0
                                                                                            • Opcode ID: ff7619c0eea8c6e62d2aa85f69db1bff7275b0abfb29cf870ebbf407352b7abf
                                                                                            • Instruction ID: ae782786201ba4ee72a96fe4b49701c5e655f2b9b11a4e3c25a0dcc3769f43c5
                                                                                            • Opcode Fuzzy Hash: ff7619c0eea8c6e62d2aa85f69db1bff7275b0abfb29cf870ebbf407352b7abf
                                                                                            • Instruction Fuzzy Hash: C7023C716142409FD714DF29C891E2ABBE5EF49318F18C49DF84ADB2A2DB31EC46CB61
                                                                                            Function 00DD8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLocalTime.KERNEL32(?), ref: 00DD8257
                                                                                            • SystemTimeToFileTime.KERNEL32(?,?), ref: 00DD8267
                                                                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DD8273
                                                                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DD8310
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD8324
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD8356
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DD838C
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD8395
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentDirectoryTime$File$Local$System
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1464919966-438819550
                                                                                            • Opcode ID: 230dd494c15fb438ce1f3ba710be5779af0e2d7761b6f531194ece997e414862
                                                                                            • Instruction ID: 3f404b69fd9af07c212822292f70ad5a867e6454574f467f4721e52f3ae012e2
                                                                                            • Opcode Fuzzy Hash: 230dd494c15fb438ce1f3ba710be5779af0e2d7761b6f531194ece997e414862
                                                                                            • Instruction Fuzzy Hash: 856126B25043459FCB10EF64C8409AEB3E8FF89314F04895AE999D7251EB31E949CBB2
                                                                                            Function 00DCD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D63A97,?,?,00D62E7F,?,?,?,00000000), ref: 00D63AC2
                                                                                              • Part of subcall function 00DCE199: GetFileAttributesW.KERNEL32(?,00DCCF95), ref: 00DCE19A
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DCD122
                                                                                            • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00DCD1DD
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 00DCD1F0
                                                                                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 00DCD20D
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DCD237
                                                                                              • Part of subcall function 00DCD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00DCD21C,?,?), ref: 00DCD2B2
                                                                                            • FindClose.KERNEL32(00000000,?,?,?), ref: 00DCD253
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DCD264
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                                            • String ID: \*.*
                                                                                            • API String ID: 1946585618-1173974218
                                                                                            • Opcode ID: 8b49ae97f6705a4b4752812f882592c190f42ca3462d7c5346afd049277b7ea0
                                                                                            • Instruction ID: 81bfd9523a9e637e749981fa8b6e8776cd85a3ad944ccaafa229e1cab941df67
                                                                                            • Opcode Fuzzy Hash: 8b49ae97f6705a4b4752812f882592c190f42ca3462d7c5346afd049277b7ea0
                                                                                            • Instruction Fuzzy Hash: F361193180120A9BCF05EBA4DE52EEDB7BAEF55300F644169E44177191EB309F09DB70
                                                                                            Function 00DDED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                            • String ID:
                                                                                            • API String ID: 1737998785-0
                                                                                            • Opcode ID: fcdc64d10e3f6133a46615096d9f51a7bfac81d5b7217f12cc4342ca2273b211
                                                                                            • Instruction ID: c76b8d8119567484ae8ac52a83805e1a42b2c862847d57c58aa4bd242244cdf0
                                                                                            • Opcode Fuzzy Hash: fcdc64d10e3f6133a46615096d9f51a7bfac81d5b7217f12cc4342ca2273b211
                                                                                            • Instruction Fuzzy Hash: 29418D35214611AFE720EF15D888B29BBE5EF44318F18C09AE459CF762C775EC41CBA0
                                                                                            Function 00DCE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DC170D
                                                                                              • Part of subcall function 00DC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DC173A
                                                                                              • Part of subcall function 00DC16C3: GetLastError.KERNEL32 ref: 00DC174A
                                                                                            • ExitWindowsEx.USER32(?,00000000), ref: 00DCE932
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                            • String ID: $ $@$SeShutdownPrivilege
                                                                                            • API String ID: 2234035333-3163812486
                                                                                            • Opcode ID: f3904c743e1687a48a61f7049bc9e4a62a398fb42b16ebe71f0d19b735d56152
                                                                                            • Instruction ID: e095a1fdf9210d37dd41e50d10acc7acce8313f5974596c7040fa107af8f77de
                                                                                            • Opcode Fuzzy Hash: f3904c743e1687a48a61f7049bc9e4a62a398fb42b16ebe71f0d19b735d56152
                                                                                            • Instruction Fuzzy Hash: CE01D6B2620326ABEB6427B49C86FBF735CE715750F194529FD02E31D2DDB09C408AB4
                                                                                            Function 00DE1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00DE1276
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1283
                                                                                            • bind.WSOCK32(00000000,?,00000010), ref: 00DE12BA
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE12C5
                                                                                            • closesocket.WSOCK32(00000000), ref: 00DE12F4
                                                                                            • listen.WSOCK32(00000000,00000005), ref: 00DE1303
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE130D
                                                                                            • closesocket.WSOCK32(00000000), ref: 00DE133C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$closesocket$bindlistensocket
                                                                                            • String ID:
                                                                                            • API String ID: 540024437-0
                                                                                            • Opcode ID: c74f75d11276f7bf9ce3aec90bf81b6eea374c56713d5dbed09702bff10b167b
                                                                                            • Instruction ID: 7225e4ee60554da5fb05842eb6391cc544aae81b6479fcbc4e3623a0f0999107
                                                                                            • Opcode Fuzzy Hash: c74f75d11276f7bf9ce3aec90bf81b6eea374c56713d5dbed09702bff10b167b
                                                                                            • Instruction Fuzzy Hash: 6C41AF356002409FD710EF65C989B69BBE5BF86318F188188E9568F3A2C771EC81CBB1
                                                                                            Function 00DCD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D63A97,?,?,00D62E7F,?,?,?,00000000), ref: 00D63AC2
                                                                                              • Part of subcall function 00DCE199: GetFileAttributesW.KERNEL32(?,00DCCF95), ref: 00DCE19A
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DCD420
                                                                                            • DeleteFileW.KERNEL32(?,?,?,?), ref: 00DCD470
                                                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DCD481
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DCD498
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DCD4A1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                                            • String ID: \*.*
                                                                                            • API String ID: 2649000838-1173974218
                                                                                            • Opcode ID: 3f68b8e602306779176160ef466e3d8cab6376e33a56ddbbcc928ea5fb67a11f
                                                                                            • Instruction ID: 798e777002a3e157f2807eb225667ab23bc6343c0dc8b03bdcd1c8cb4ed807d9
                                                                                            • Opcode Fuzzy Hash: 3f68b8e602306779176160ef466e3d8cab6376e33a56ddbbcc928ea5fb67a11f
                                                                                            • Instruction Fuzzy Hash: 26316B7101C3459BC204EF64D9919AFB7A9EE92304F485A2EF4D593291EB30EA09DB72
                                                                                            Function 00D9E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: __floor_pentium4
                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                            • API String ID: 4168288129-2761157908
                                                                                            • Opcode ID: c6db9593f0650458eb352ebb271a1d49379858d4e87b1eaabac1c913f6f18394
                                                                                            • Instruction ID: da3486b13f66aa97f65f66f3510d502e3d730a1fdf3ebdbf8e1ad8ba7d487837
                                                                                            • Opcode Fuzzy Hash: c6db9593f0650458eb352ebb271a1d49379858d4e87b1eaabac1c913f6f18394
                                                                                            • Instruction Fuzzy Hash: 7DC22772E086288BDF65DF68DD407EAB7B5EB48305F1841EAD44DE7240E774AE818F60
                                                                                            Function 00DD648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00DD64DC
                                                                                            • CoInitialize.OLE32(00000000), ref: 00DD6639
                                                                                            • CoCreateInstance.OLE32(00DFFCF8,00000000,00000001,00DFFB68,?), ref: 00DD6650
                                                                                            • CoUninitialize.OLE32 ref: 00DD68D4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                            • String ID: .lnk
                                                                                            • API String ID: 886957087-24824748
                                                                                            • Opcode ID: bb23e2b8b473b0c2776109f9bcc6cebd5bddfbc93e380c16f4d958fdaa925a43
                                                                                            • Instruction ID: 4714bae0005b92ec73ba6d39c5bcb615d43fb0280503ee6cf1d78938d8081d70
                                                                                            • Opcode Fuzzy Hash: bb23e2b8b473b0c2776109f9bcc6cebd5bddfbc93e380c16f4d958fdaa925a43
                                                                                            • Instruction Fuzzy Hash: 87D14671508341AFC304EF24C891A6BB7E9FF98704F04496DF5958B2A1EB71E949CBB2
                                                                                            Function 00DE22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32(?,?,00000000), ref: 00DE22E8
                                                                                              • Part of subcall function 00DDE4EC: GetWindowRect.USER32(?,?), ref: 00DDE504
                                                                                            • GetDesktopWindow.USER32 ref: 00DE2312
                                                                                            • GetWindowRect.USER32(00000000), ref: 00DE2319
                                                                                            • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00DE2355
                                                                                            • GetCursorPos.USER32(?), ref: 00DE2381
                                                                                            • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00DE23DF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                                            • String ID:
                                                                                            • API String ID: 2387181109-0
                                                                                            • Opcode ID: 4dcc2f0d2f1bebefc80899c9138d3a15ee871d48f3a4b43be00808df1938d2ab
                                                                                            • Instruction ID: fca35175bd2cc8794bb07fb88a08503ca1ca3043a1c1eb890cde337c0dfb82cd
                                                                                            • Opcode Fuzzy Hash: 4dcc2f0d2f1bebefc80899c9138d3a15ee871d48f3a4b43be00808df1938d2ab
                                                                                            • Instruction Fuzzy Hash: 6B31BE72504355ABC720EF55C845B6BB7AAFB84314F00191DF985D7291DA34EA18CBA2
                                                                                            Function 00DD9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00DD9B78
                                                                                            • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00DD9C8B
                                                                                              • Part of subcall function 00DD3874: GetInputState.USER32 ref: 00DD38CB
                                                                                              • Part of subcall function 00DD3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DD3966
                                                                                            • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00DD9BA8
                                                                                            • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00DD9C75
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                                            • String ID: *.*
                                                                                            • API String ID: 1972594611-438819550
                                                                                            • Opcode ID: 97083e5410dfec36268a6b2997839b1abe8bced3cb7412570080ab6d68ad6438
                                                                                            • Instruction ID: 554ef5e2cd3105a5a906678db915477363d3cdb8b94a83bc7dfcc434b979b475
                                                                                            • Opcode Fuzzy Hash: 97083e5410dfec36268a6b2997839b1abe8bced3cb7412570080ab6d68ad6438
                                                                                            • Instruction Fuzzy Hash: 4E41717191420AAFCF14DFA8D995AEEBBB8EF05310F244156E805A72A1EB319E54CF70
                                                                                            Function 00D7997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • DefDlgProcW.USER32(?,?,?,?,?), ref: 00D79A4E
                                                                                            • GetSysColor.USER32(0000000F), ref: 00D79B23
                                                                                            • SetBkColor.GDI32(?,00000000), ref: 00D79B36
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$LongProcWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3131106179-0
                                                                                            • Opcode ID: a378af897f5706b29b750f78f394818eafca0da6312c83aed26b8afba613aeb7
                                                                                            • Instruction ID: 9e87e6f891c85f90c2598db5555e35d85a53aaa8fac6449f414b3c6e1493122d
                                                                                            • Opcode Fuzzy Hash: a378af897f5706b29b750f78f394818eafca0da6312c83aed26b8afba613aeb7
                                                                                            • Instruction Fuzzy Hash: 97A12A72109408FFE7289A3D8CA9EBBAA9DDBC2310F19C109F147D6695EA21DD01D376
                                                                                            Function 00DE1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DE307A
                                                                                              • Part of subcall function 00DE304E: _wcslen.LIBCMT ref: 00DE309B
                                                                                            • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00DE185D
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1884
                                                                                            • bind.WSOCK32(00000000,?,00000010), ref: 00DE18DB
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE18E6
                                                                                            • closesocket.WSOCK32(00000000), ref: 00DE1915
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                                            • String ID:
                                                                                            • API String ID: 1601658205-0
                                                                                            • Opcode ID: e4a66275e81eb72bfceeb370254033925a2473ff6711a389fafc4f54b9442e56
                                                                                            • Instruction ID: ccc3101214a22b4ef41eecd315468e2bed5d20f4f6bed069ee319c0a4f989764
                                                                                            • Opcode Fuzzy Hash: e4a66275e81eb72bfceeb370254033925a2473ff6711a389fafc4f54b9442e56
                                                                                            • Instruction Fuzzy Hash: 3C519F75A00210AFDB10AF24C886F6A77A5EB48718F088098F95A9F3D3D671AD41CBB1
                                                                                            Function 00DF1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                            • String ID:
                                                                                            • API String ID: 292994002-0
                                                                                            • Opcode ID: 4ba6455b2948b26ab651e97fbadb7c24f8aaf3572b7f70c54c6b0f5cfee4c461
                                                                                            • Instruction ID: 66cb4ed60154ab1d3a2b5b14840b37d44a5f105d94891395663a92f5a41a512d
                                                                                            • Opcode Fuzzy Hash: 4ba6455b2948b26ab651e97fbadb7c24f8aaf3572b7f70c54c6b0f5cfee4c461
                                                                                            • Instruction Fuzzy Hash: EE21B1357402489FD7208F1AC844B3ABBA5EF85324B1ED058E946CB351C771EC42CBB0
                                                                                            Function 00D68060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                                            • API String ID: 0-1546025612
                                                                                            • Opcode ID: a10ed307f69f284cb9b10cdf2a92224a7daac8bdc3f10efff95933515112019d
                                                                                            • Instruction ID: c438292b5a6e1d2883239d709bfe849e73cfc95e8e43123506a759aa92b54f90
                                                                                            • Opcode Fuzzy Hash: a10ed307f69f284cb9b10cdf2a92224a7daac8bdc3f10efff95933515112019d
                                                                                            • Instruction Fuzzy Hash: 87A27071E0061ACBDF24CF58C8407ADB7B1BF55310F2886AAE855A7285EB74DD81DFA0
                                                                                            Function 00DC8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00DC82AA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrlen
                                                                                            • String ID: ($tb$|
                                                                                            • API String ID: 1659193697-1968160224
                                                                                            • Opcode ID: 5ebc0447c0b61c745423e19da026153189267112ed400986fa56801194d39226
                                                                                            • Instruction ID: 24bc3501c808614bbfcd181bc3ff19031dab4df74f21784977560d6eafb17ea3
                                                                                            • Opcode Fuzzy Hash: 5ebc0447c0b61c745423e19da026153189267112ed400986fa56801194d39226
                                                                                            • Instruction Fuzzy Hash: FA323375A006069FCB28CF59C481E6AB7F0FF48710B15C56EE49ADB3A1EB70E941CB64
                                                                                            Function 00DCAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00DCAAAC
                                                                                            • SetKeyboardState.USER32(00000080), ref: 00DCAAC8
                                                                                            • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00DCAB36
                                                                                            • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00DCAB88
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: KeyboardState$InputMessagePostSend
                                                                                            • String ID:
                                                                                            • API String ID: 432972143-0
                                                                                            • Opcode ID: f3a698e4be92245364d27744425f90003d3cc842eb3a4ea4692787e9c7a2552e
                                                                                            • Instruction ID: 3f0936ee28979cc6eadc00164d5cebb15e3e47ed230a14a5a539501525a6163b
                                                                                            • Opcode Fuzzy Hash: f3a698e4be92245364d27744425f90003d3cc842eb3a4ea4692787e9c7a2552e
                                                                                            • Instruction Fuzzy Hash: 6231F570A4024DAEEB258A6CCC05FFA7BA7AB44314F08421EF191971D1D7758D91C772
                                                                                            Function 00D9BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00D9BB7F
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • GetTimeZoneInformation.KERNEL32 ref: 00D9BB91
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,?,00E3121C,000000FF,?,0000003F,?,?), ref: 00D9BC09
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,?,00E31270,000000FF,?,0000003F,?,?,?,00E3121C,000000FF,?,0000003F,?,?), ref: 00D9BC36
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                                                            • String ID:
                                                                                            • API String ID: 806657224-0
                                                                                            • Opcode ID: dcd380348eb7176f2f26062b22146543a72da8a0fae768a144404bcd4780fd8d
                                                                                            • Instruction ID: 105ba4c424b614a101fe394ff17a0d7ab4210f37382b9ca991d966db6cdb81b5
                                                                                            • Opcode Fuzzy Hash: dcd380348eb7176f2f26062b22146543a72da8a0fae768a144404bcd4780fd8d
                                                                                            • Instruction Fuzzy Hash: 9D319E70904209DFCF11DF69AD8592ABFB8FF45760B1982AEE451EB2B1D7309904DB60
                                                                                            Function 00DDCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetReadFile.WININET(?,?,00000400,?), ref: 00DDCE89
                                                                                            • GetLastError.KERNEL32(?,00000000), ref: 00DDCEEA
                                                                                            • SetEvent.KERNEL32(?,?,00000000), ref: 00DDCEFE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorEventFileInternetLastRead
                                                                                            • String ID:
                                                                                            • API String ID: 234945975-0
                                                                                            • Opcode ID: a79460f8160223c67f31bd83215b61ae772fcc7c7fdaf43124ebd3500988c6f9
                                                                                            • Instruction ID: ade3f297492a790af2f4095b7003b915c3145492103d0631d376a1008362ed9b
                                                                                            • Opcode Fuzzy Hash: a79460f8160223c67f31bd83215b61ae772fcc7c7fdaf43124ebd3500988c6f9
                                                                                            • Instruction Fuzzy Hash: F42189B1510306ABEB20DFA5CA49BABB7FCEF40354F14941AE546D2291E770EE04DB74
                                                                                            Function 00DD5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DD5CC1
                                                                                            • FindNextFileW.KERNEL32(00000000,?), ref: 00DD5D17
                                                                                            • FindClose.KERNEL32(?), ref: 00DD5D5F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$File$CloseFirstNext
                                                                                            • String ID:
                                                                                            • API String ID: 3541575487-0
                                                                                            • Opcode ID: caa1c799cd5a3e1384feb4b9b51188d99691b5f9eaf3245df024b7bf517c818c
                                                                                            • Instruction ID: 753144be602215ae3d3837581360c9f7995a188d0d0c5937f9e65dbe355b954d
                                                                                            • Opcode Fuzzy Hash: caa1c799cd5a3e1384feb4b9b51188d99691b5f9eaf3245df024b7bf517c818c
                                                                                            • Instruction Fuzzy Hash: E9517634604B019FC714DF28D494AAAB7E5FF49314F18855EE99A8B3A2DB30E944CFB1
                                                                                            Function 00D92622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsDebuggerPresent.KERNEL32 ref: 00D9271A
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D92724
                                                                                            • UnhandledExceptionFilter.KERNEL32(?), ref: 00D92731
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                            • String ID:
                                                                                            • API String ID: 3906539128-0
                                                                                            • Opcode ID: 61b36d5d39377c6b5e6c6ff15bbc065606f06101bc0907638810f64b25718c8a
                                                                                            • Instruction ID: 7b13992b798775ee25adfd8ed0a424ea239c99c8d8084da77490fa681a6a807c
                                                                                            • Opcode Fuzzy Hash: 61b36d5d39377c6b5e6c6ff15bbc065606f06101bc0907638810f64b25718c8a
                                                                                            • Instruction Fuzzy Hash: 6B31C47491121CABCB21DF64DD88B9CBBB8EF08310F5041EAE41CA6260E7309F858F54
                                                                                            Function 00DD51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00DD51DA
                                                                                            • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DD5238
                                                                                            • SetErrorMode.KERNEL32(00000000), ref: 00DD52A1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$DiskFreeSpace
                                                                                            • String ID:
                                                                                            • API String ID: 1682464887-0
                                                                                            • Opcode ID: 2d10449e893364a4a4b6c783a22cb5cde75affc8d8b7b58d7bcab841a6036418
                                                                                            • Instruction ID: 37b175be30766f08e3c75a294401560851ec259183bb0bf72ad0000b8b17dc2f
                                                                                            • Opcode Fuzzy Hash: 2d10449e893364a4a4b6c783a22cb5cde75affc8d8b7b58d7bcab841a6036418
                                                                                            • Instruction Fuzzy Hash: 2A314175A10618DFDB00DF54D884EADBBB5FF49314F088099E845AB396DB31E85ACBA0
                                                                                            Function 00DC16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00D80668
                                                                                              • Part of subcall function 00D7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00D80685
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DC170D
                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DC173A
                                                                                            • GetLastError.KERNEL32 ref: 00DC174A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                                            • String ID:
                                                                                            • API String ID: 577356006-0
                                                                                            • Opcode ID: bad11f016c05999b2c25c623145d9e39f8d61bd11fd783b11782b781ecc418bf
                                                                                            • Instruction ID: 55e65c4dc6d34ca747d16a8c747365569bf5bf29bf701b5f50d70821047708aa
                                                                                            • Opcode Fuzzy Hash: bad11f016c05999b2c25c623145d9e39f8d61bd11fd783b11782b781ecc418bf
                                                                                            • Instruction Fuzzy Hash: C6118FB2414309FFD7289F54DC86E6AB7B9EB45754B24C52EE05697281EB70BC41CA30
                                                                                            Function 00DCD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DCD608
                                                                                            • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00DCD645
                                                                                            • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DCD650
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                            • String ID:
                                                                                            • API String ID: 33631002-0
                                                                                            • Opcode ID: 52636c64bb770f3d167a68b957e5a2315c10f85fb67f2255bf1e3956746fa481
                                                                                            • Instruction ID: e12c7c8d7fc988960321b7a3f24cc9e10faa8402b678a6e0c2b2e9eb2df03239
                                                                                            • Opcode Fuzzy Hash: 52636c64bb770f3d167a68b957e5a2315c10f85fb67f2255bf1e3956746fa481
                                                                                            • Instruction Fuzzy Hash: 58117C71E01328BBDB108F989C44FAFBBBCEB45B50F108126F904E7290D2704A01CBA1
                                                                                            Function 00DC1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00DC168C
                                                                                            • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00DC16A1
                                                                                            • FreeSid.ADVAPI32(?), ref: 00DC16B1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                            • String ID:
                                                                                            • API String ID: 3429775523-0
                                                                                            • Opcode ID: 1989c23e670ecd7a0d01f53261385cecdf23e926d41249a82efd24941ec1204d
                                                                                            • Instruction ID: 7ffb3a60fa7da1173807431ac5cba0181d47028166c93acec78f5278cec28989
                                                                                            • Opcode Fuzzy Hash: 1989c23e670ecd7a0d01f53261385cecdf23e926d41249a82efd24941ec1204d
                                                                                            • Instruction Fuzzy Hash: 2CF0447195030DFBDB00CFE08D89EAEBBBCEB08200F008864E500E2281E730AA049A60
                                                                                            Function 00DBD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetUserNameW.ADVAPI32(?,?), ref: 00DBD28C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: NameUser
                                                                                            • String ID: X64
                                                                                            • API String ID: 2645101109-893830106
                                                                                            • Opcode ID: 1f43bf6244cd951695c6174dc99026f1d36e94e2361f2bed168597c6479da128
                                                                                            • Instruction ID: b1f466379831952f41777682bdd99bc90febb12781010ad8cd46e9fd73a1dbb2
                                                                                            • Opcode Fuzzy Hash: 1f43bf6244cd951695c6174dc99026f1d36e94e2361f2bed168597c6479da128
                                                                                            • Instruction Fuzzy Hash: 4AD0C9B481111DEACB94CB90EC88DD9B37CBF04305F104155F146E2100EB3095498F20
                                                                                            Function 00D8CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                            • Instruction ID: a3482202bcfe786ab4ed1731cbd10fefbe14b31a0232e5ba443e07b6ee5897ee
                                                                                            • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                                            • Instruction Fuzzy Hash: 59021C71E11119DBDF14DFA9C8806ADFBF1FF48314F29816AE919E7380D731A9418BA4
                                                                                            Function 00D6CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Variable is not of type 'Object'.$p#
                                                                                            • API String ID: 0-1086706999
                                                                                            • Opcode ID: fcf5fee6954e27a7edf1d51c41bd302d238ea54207d4ee4b8eed76659735215e
                                                                                            • Instruction ID: b619836a4e23dfd910cb0f6f22710076e257a5de85f4cce7328d79c21420b0d0
                                                                                            • Opcode Fuzzy Hash: fcf5fee6954e27a7edf1d51c41bd302d238ea54207d4ee4b8eed76659735215e
                                                                                            • Instruction Fuzzy Hash: C5324770910218DBCF14DF94C885AFEBBB5FF05304F189059E886AB292DB75AE49CB71
                                                                                            Function 00DD68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 00DD6918
                                                                                            • FindClose.KERNEL32(00000000), ref: 00DD6961
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Find$CloseFileFirst
                                                                                            • String ID:
                                                                                            • API String ID: 2295610775-0
                                                                                            • Opcode ID: 191b37646ee90d7f33c927afcd5245c1877e3044d8df04abffc0b426553da0ff
                                                                                            • Instruction ID: b30147f8cf14360f7ff2f43fcad6475f2fb5acebd71355b83cc0ee1191dc226a
                                                                                            • Opcode Fuzzy Hash: 191b37646ee90d7f33c927afcd5245c1877e3044d8df04abffc0b426553da0ff
                                                                                            • Instruction Fuzzy Hash: 4E1190316142009FC710DF69D484A26BBE5FF89328F18C69AE4698F3A2C730EC05CBE1
                                                                                            Function 00DD37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00DE4891,?,?,00000035,?), ref: 00DD37E4
                                                                                            • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00DE4891,?,?,00000035,?), ref: 00DD37F4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorFormatLastMessage
                                                                                            • String ID:
                                                                                            • API String ID: 3479602957-0
                                                                                            • Opcode ID: 932eb3f59bfa63cc15a74f2d90107a21dca9b4d0e782c7c11e743dff885640f8
                                                                                            • Instruction ID: 16b358d0fcad72a13fa54d12abbe053b29e008c5a072935ff3df0166f6141eeb
                                                                                            • Opcode Fuzzy Hash: 932eb3f59bfa63cc15a74f2d90107a21dca9b4d0e782c7c11e743dff885640f8
                                                                                            • Instruction Fuzzy Hash: A6F055B06043293BE72013A68C4CFEB3AAEEFC4760F000122F508E2380C9608904C7B0
                                                                                            Function 00DCB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00DCB25D
                                                                                            • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00DCB270
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: InputSendkeybd_event
                                                                                            • String ID:
                                                                                            • API String ID: 3536248340-0
                                                                                            • Opcode ID: bcf2b308388aa1004f71bb6adb67a45228c698f8c52957990fcd06aa70eeb5eb
                                                                                            • Instruction ID: 3a791d38801ce917fc543c4b4da5136be9dcd026ae838b56482e4fa40f36d75c
                                                                                            • Opcode Fuzzy Hash: bcf2b308388aa1004f71bb6adb67a45228c698f8c52957990fcd06aa70eeb5eb
                                                                                            • Instruction Fuzzy Hash: 47F01D7181428EABDB059FA0C806BBEBBB4FF04315F04940AF955A6291C379D615DFA4
                                                                                            Function 00DC10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DC11FC), ref: 00DC10D4
                                                                                            • CloseHandle.KERNEL32(?,?,00DC11FC), ref: 00DC10E9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AdjustCloseHandlePrivilegesToken
                                                                                            • String ID:
                                                                                            • API String ID: 81990902-0
                                                                                            • Opcode ID: dffb61d94429d2bad6f6beb29dd52ae6cd08bb1e082b83475f5bb65da5fc134a
                                                                                            • Instruction ID: 6f96b5afbd7c1d15da70bc6ae38dea9093e6edbcb0e1ec4771f292c38ae19638
                                                                                            • Opcode Fuzzy Hash: dffb61d94429d2bad6f6beb29dd52ae6cd08bb1e082b83475f5bb65da5fc134a
                                                                                            • Instruction Fuzzy Hash: BBE04F32018710AEE7352B11FC05E7377E9EF04310B14C82EF4A5804B1EB626CA0EB30
                                                                                            Function 00D9676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00D96766,?,?,00000008,?,?,00D9FEFE,00000000), ref: 00D96998
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionRaise
                                                                                            • String ID:
                                                                                            • API String ID: 3997070919-0
                                                                                            • Opcode ID: c71f8dcce732b241f68d0cad606e4edef130004442054d8c8f61cc11127bf823
                                                                                            • Instruction ID: 68c023fdef722f257016ab1e309a3de9209dd476d5f1b3366af539398ad09dea
                                                                                            • Opcode Fuzzy Hash: c71f8dcce732b241f68d0cad606e4edef130004442054d8c8f61cc11127bf823
                                                                                            • Instruction Fuzzy Hash: 6CB139316106089FDB19CF28C48AB657BE0FF45364F298658E8E9CF2E2C335E991CB50
                                                                                            Function 00D7B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID: 0-3916222277
                                                                                            • Opcode ID: 684a21c352f7599b3ce7bd57874c49bd55545d2d35e40765cde82c0cb5cb5944
                                                                                            • Instruction ID: 4fc554390e93804f5464b0e9759718aa0b8fc3f1ab1368ae4c8b6fbdfe9df5e8
                                                                                            • Opcode Fuzzy Hash: 684a21c352f7599b3ce7bd57874c49bd55545d2d35e40765cde82c0cb5cb5944
                                                                                            • Instruction Fuzzy Hash: 27123E75900229DFCB24CF58C8817EEB7F5EF48714F14819AE849EB255EB349A81DFA0
                                                                                            Function 00DDEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • BlockInput.USER32(00000001), ref: 00DDEABD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BlockInput
                                                                                            • String ID:
                                                                                            • API String ID: 3456056419-0
                                                                                            • Opcode ID: 61a36423c83b62f7a76e107ace008feaa48fe7873b77582db9cb349de1d1ac71
                                                                                            • Instruction ID: 1407873bac92cc7f577876a085917876883a9301e23e9407f4afc9b1d67778cd
                                                                                            • Opcode Fuzzy Hash: 61a36423c83b62f7a76e107ace008feaa48fe7873b77582db9cb349de1d1ac71
                                                                                            • Instruction Fuzzy Hash: 75E01A312102059FC710EF59D804E9AB7E9EF98760F009417FC4ACB361DAB0E8408BB0
                                                                                            Function 00D809D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00D803EE), ref: 00D809DA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ExceptionFilterUnhandled
                                                                                            • String ID:
                                                                                            • API String ID: 3192549508-0
                                                                                            • Opcode ID: 4bcb9f6caf6d755b47346e5c6c7259b68c5da913bd75e3c8692cb97e43c2a251
                                                                                            • Instruction ID: e6b9c4d988fc289b3ef8545a3d2ac004f73613898a8f9421239e3dadb7821281
                                                                                            • Opcode Fuzzy Hash: 4bcb9f6caf6d755b47346e5c6c7259b68c5da913bd75e3c8692cb97e43c2a251
                                                                                            • Instruction Fuzzy Hash:
                                                                                            Function 00D8781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0
                                                                                            • API String ID: 0-4108050209
                                                                                            • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                            • Instruction ID: a262749e97b1df794153fd69402b0d9e44927cf8c67f0c355917633ccd970fee
                                                                                            • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                                            • Instruction Fuzzy Hash: 3751ABB160C7055BDF38B628889EBBE27A9DB02340F7C0509D8CBC7282D611DE01E772
                                                                                            Function 00DD2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 0&
                                                                                            • API String ID: 0-2523485602
                                                                                            • Opcode ID: 9425958e2224f2819348f6de47563f8e842300c1db1450a2341a6910bb1864e1
                                                                                            • Instruction ID: 26b3b4757858ce23b1bf4e48f7e1ff2587533c17fe09ea544a4f5486caaa620e
                                                                                            • Opcode Fuzzy Hash: 9425958e2224f2819348f6de47563f8e842300c1db1450a2341a6910bb1864e1
                                                                                            • Instruction Fuzzy Hash: 7221E7323206158BD728CF79C82367E77E5AB64320F18862EE4A7D37D0DE35A904CB90
                                                                                            Function 00D96DD9 Relevance: .6, Instructions: 637COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f1be5a27f9368ce4d425b1a8da83763b14936e227828820164e3d86b0c8abc04
                                                                                            • Instruction ID: 77dff64ef0d78c27f5169a3b6fb22d14ad4253d3263915ae5a8e22157a02b4eb
                                                                                            • Opcode Fuzzy Hash: f1be5a27f9368ce4d425b1a8da83763b14936e227828820164e3d86b0c8abc04
                                                                                            • Instruction Fuzzy Hash: 7F322422D79F014DDB639635CC26335A289AFB73C5F15D737E81AB59AAEB29C4C34100
                                                                                            Function 00D7CC39 Relevance: .6, Instructions: 635COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 271b791473b8358ca1f32099bd7feab8b7fa5891f44db2e210211be0d2e77b61
                                                                                            • Instruction ID: 8cc2f42f565db33ab84ad984578742502b37cc9f03e98b2ac6052042aace490f
                                                                                            • Opcode Fuzzy Hash: 271b791473b8358ca1f32099bd7feab8b7fa5891f44db2e210211be0d2e77b61
                                                                                            • Instruction Fuzzy Hash: 9232E031A20115CFDF39CA29C494AFD7BA1FB85300F2CA56BD49B9B291E634DD81DA70
                                                                                            Function 00D67920 Relevance: .6, Instructions: 563COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 72013c951b150de38a5da1597691ebb918150ad3d8d1dff148cf644933a3f4cb
                                                                                            • Instruction ID: 048ce9a89af4b031c23263c31c72a9b592363e9d4e4845fd61d154746d3deff4
                                                                                            • Opcode Fuzzy Hash: 72013c951b150de38a5da1597691ebb918150ad3d8d1dff148cf644933a3f4cb
                                                                                            • Instruction Fuzzy Hash: CE22DFB0A00609DFDF14CFA8D881AAEB3F5FF45304F244529E856A7295EB36E915CB70
                                                                                            Function 00D691C0 Relevance: .5, Instructions: 475COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2f80bb189ea717a03208a96aee4e7b34ffd5ab5233592208bf017dd6e54ed5fe
                                                                                            • Instruction ID: 93582e622a5bcd99cd799333f89d17e901b689c056a400d7be6c92eb63c937ad
                                                                                            • Opcode Fuzzy Hash: 2f80bb189ea717a03208a96aee4e7b34ffd5ab5233592208bf017dd6e54ed5fe
                                                                                            • Instruction Fuzzy Hash: 3202C4B0A00205EFDB14DF64D891AAEB7B5FF44300F548169F85ADB291EB31EA15CBB1
                                                                                            Function 00D99EEE Relevance: .3, Instructions: 294COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 744913fd86842b01a7d9ddedd8e080effd1e0b8c62058a8e73b586b025940e20
                                                                                            • Instruction ID: de7c0431a93b90d786e89bd52a20c2faf1b9ce2346e651e243ded09c7b0b5354
                                                                                            • Opcode Fuzzy Hash: 744913fd86842b01a7d9ddedd8e080effd1e0b8c62058a8e73b586b025940e20
                                                                                            • Instruction Fuzzy Hash: 67B11321E2AF404DC723963A8871336B65CAFBB6D5F91D31BFC2674D62EB2686C74140
                                                                                            Function 00D81C77 Relevance: .3, Instructions: 254COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                            • Instruction ID: 3937d143d776ee9ae1ff87dd0c8b036093c07bb75fe52ab361034adf2314130e
                                                                                            • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                                            • Instruction Fuzzy Hash: 2391777B1080A34ADB2A563A857417EFFE95A923A131E079DE4F2CA1C5FE10C95ED730
                                                                                            Function 00D81F32 Relevance: .2, Instructions: 244COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                            • Instruction ID: 2bae6a14d09e92b2d118126befcb260f7ced4adec63ec0085cef312fe4f34b0a
                                                                                            • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                                            • Instruction Fuzzy Hash: 0E9185772081A34EDB69523A847843EFFE55A923A131E079EE4F2CB1C5EE24C559E730
                                                                                            Function 00D819B0 Relevance: .2, Instructions: 240COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                            • Instruction ID: c99e0ff8edb7d3a90de177f7a1c127d48f6f2fa27a68dd897eec516fca4352b0
                                                                                            • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                                            • Instruction Fuzzy Hash: 9191927A2090A34ADB2D567A847403EFFE95A923A231E079ED4F2CA1C1FE14D55E9730
                                                                                            Function 00D87A4A Relevance: .2, Instructions: 237COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8964940d5bca2dceb5dd420da751d15488dc609cc8fe217884aeacbbe91b45a1
                                                                                            • Instruction ID: 2f60e9ac19e88465009dc18dcb8b1ea8f02ec613252927a011524e9ae312715c
                                                                                            • Opcode Fuzzy Hash: 8964940d5bca2dceb5dd420da751d15488dc609cc8fe217884aeacbbe91b45a1
                                                                                            • Instruction Fuzzy Hash: 67616971608709A6DA38BA288C95BBE6396DF51700F7C0919E886DB281DA11FE42D375
                                                                                            Function 00D87CA7 Relevance: .2, Instructions: 237COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 52e815ed6fa02eaad5f93cb8c7db0d1900579dc6ea23ce611e5e52378c8e4371
                                                                                            • Instruction ID: c64e193a23f3e21c33ce4f9bfe879507f520e0db1d6c4a98da70e4bb5dd73065
                                                                                            • Opcode Fuzzy Hash: 52e815ed6fa02eaad5f93cb8c7db0d1900579dc6ea23ce611e5e52378c8e4371
                                                                                            • Instruction Fuzzy Hash: 86619F7160C70AD7DE397A284855BBF6388EF42744F3C1959F883DB281E612ED429375
                                                                                            Function 00D81706 Relevance: .2, Instructions: 232COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                            • Instruction ID: 4af64c68e84c26dd7bd9fc1b82d95030969756a18ed7708d0b1b504a49642344
                                                                                            • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                                            • Instruction Fuzzy Hash: 9B81963A6080A349DB2D623A853547EFFE55A923A131E079DD4F2CB1C1EE24C55EDB30
                                                                                            Function 00DE2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DE2B30
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DE2B43
                                                                                            • DestroyWindow.USER32 ref: 00DE2B52
                                                                                            • GetDesktopWindow.USER32 ref: 00DE2B6D
                                                                                            • GetWindowRect.USER32(00000000), ref: 00DE2B74
                                                                                            • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00DE2CA3
                                                                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00DE2CB1
                                                                                            • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2CF8
                                                                                            • GetClientRect.USER32(00000000,?), ref: 00DE2D04
                                                                                            • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00DE2D40
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2D62
                                                                                            • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2D75
                                                                                            • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2D80
                                                                                            • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2D89
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2D98
                                                                                            • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2DA1
                                                                                            • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2DA8
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00DE2DB3
                                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2DC5
                                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00DFFC38,00000000), ref: 00DE2DDB
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00DE2DEB
                                                                                            • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00DE2E11
                                                                                            • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00DE2E30
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE2E52
                                                                                            • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DE303F
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                            • String ID: $AutoIt v3$DISPLAY$static
                                                                                            • API String ID: 2211948467-2373415609
                                                                                            • Opcode ID: 85922c7d16a94a0267ce58b7b642d489ea3df113fbddc1dbdbc63d10d4c8fa2e
                                                                                            • Instruction ID: a88f30ca8c73fdc9a8c626141ee23926251b5a9292f1eb676dea028adbd8a35c
                                                                                            • Opcode Fuzzy Hash: 85922c7d16a94a0267ce58b7b642d489ea3df113fbddc1dbdbc63d10d4c8fa2e
                                                                                            • Instruction Fuzzy Hash: B5026771910208AFDB14EFA5CD89EBE7BB9EB48310F048158F915EB2A1DB70AD15CB70
                                                                                            Function 00DF70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00DF712F
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00DF7160
                                                                                            • GetSysColor.USER32(0000000F), ref: 00DF716C
                                                                                            • SetBkColor.GDI32(?,000000FF), ref: 00DF7186
                                                                                            • SelectObject.GDI32(?,?), ref: 00DF7195
                                                                                            • InflateRect.USER32(?,000000FF,000000FF), ref: 00DF71C0
                                                                                            • GetSysColor.USER32(00000010), ref: 00DF71C8
                                                                                            • CreateSolidBrush.GDI32(00000000), ref: 00DF71CF
                                                                                            • FrameRect.USER32(?,?,00000000), ref: 00DF71DE
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DF71E5
                                                                                            • InflateRect.USER32(?,000000FE,000000FE), ref: 00DF7230
                                                                                            • FillRect.USER32(?,?,?), ref: 00DF7262
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF7284
                                                                                              • Part of subcall function 00DF73E8: GetSysColor.USER32(00000012), ref: 00DF7421
                                                                                              • Part of subcall function 00DF73E8: SetTextColor.GDI32(?,?), ref: 00DF7425
                                                                                              • Part of subcall function 00DF73E8: GetSysColorBrush.USER32(0000000F), ref: 00DF743B
                                                                                              • Part of subcall function 00DF73E8: GetSysColor.USER32(0000000F), ref: 00DF7446
                                                                                              • Part of subcall function 00DF73E8: GetSysColor.USER32(00000011), ref: 00DF7463
                                                                                              • Part of subcall function 00DF73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DF7471
                                                                                              • Part of subcall function 00DF73E8: SelectObject.GDI32(?,00000000), ref: 00DF7482
                                                                                              • Part of subcall function 00DF73E8: SetBkColor.GDI32(?,00000000), ref: 00DF748B
                                                                                              • Part of subcall function 00DF73E8: SelectObject.GDI32(?,?), ref: 00DF7498
                                                                                              • Part of subcall function 00DF73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00DF74B7
                                                                                              • Part of subcall function 00DF73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DF74CE
                                                                                              • Part of subcall function 00DF73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00DF74DB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                                            • String ID:
                                                                                            • API String ID: 4124339563-0
                                                                                            • Opcode ID: f469f83252892ae5b10142557b9d2347a170355cebb54573184c58bf237b6968
                                                                                            • Instruction ID: 0743b7a6451df0246bceec4bb81b390178481084b8e9dd1da79d7317cfb47657
                                                                                            • Opcode Fuzzy Hash: f469f83252892ae5b10142557b9d2347a170355cebb54573184c58bf237b6968
                                                                                            • Instruction Fuzzy Hash: 85A1A371018309BFD7009F60DD48EBB7BA9FB49320F149A19FAA2D62E1D731E954CB61
                                                                                            Function 00D78D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(?,?), ref: 00D78E14
                                                                                            • SendMessageW.USER32(?,00001308,?,00000000), ref: 00DB6AC5
                                                                                            • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00DB6AFE
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DB6F43
                                                                                              • Part of subcall function 00D78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D78BE8,?,00000000,?,?,?,?,00D78BBA,00000000,?), ref: 00D78FC5
                                                                                            • SendMessageW.USER32(?,00001053), ref: 00DB6F7F
                                                                                            • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00DB6F96
                                                                                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 00DB6FAC
                                                                                            • ImageList_Destroy.COMCTL32(00000000,?), ref: 00DB6FB7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                                            • String ID: 0
                                                                                            • API String ID: 2760611726-4108050209
                                                                                            • Opcode ID: 8c1d0667637aa38735fe91a7e98f35487216348081eee122a6a3c7db51bb1d49
                                                                                            • Instruction ID: eb6b84630596d7d60c18de694a69cb70e3692c6001b882320229549196b79289
                                                                                            • Opcode Fuzzy Hash: 8c1d0667637aa38735fe91a7e98f35487216348081eee122a6a3c7db51bb1d49
                                                                                            • Instruction Fuzzy Hash: 94128B30604205DFDB25CF24C958BBABBA5FF48300F188469F58ADB261DB36E856DB71
                                                                                            Function 00DE2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(00000000), ref: 00DE273E
                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00DE286A
                                                                                            • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00DE28A9
                                                                                            • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00DE28B9
                                                                                            • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00DE2900
                                                                                            • GetClientRect.USER32(00000000,?), ref: 00DE290C
                                                                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00DE2955
                                                                                            • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00DE2964
                                                                                            • GetStockObject.GDI32(00000011), ref: 00DE2974
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00DE2978
                                                                                            • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00DE2988
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DE2991
                                                                                            • DeleteDC.GDI32(00000000), ref: 00DE299A
                                                                                            • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00DE29C6
                                                                                            • SendMessageW.USER32(00000030,00000000,00000001), ref: 00DE29DD
                                                                                            • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00DE2A1D
                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00DE2A31
                                                                                            • SendMessageW.USER32(00000404,00000001,00000000), ref: 00DE2A42
                                                                                            • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00DE2A77
                                                                                            • GetStockObject.GDI32(00000011), ref: 00DE2A82
                                                                                            • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00DE2A8D
                                                                                            • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00DE2A97
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                                            • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                                            • API String ID: 2910397461-517079104
                                                                                            • Opcode ID: c727e0b20778131d48031356185074bff204687d725b11c7795d89414ca6b155
                                                                                            • Instruction ID: 01fb2f525bd26ff2d8d297124018bd3f33ca7cb0cf848f2a21668996a44ec6f0
                                                                                            • Opcode Fuzzy Hash: c727e0b20778131d48031356185074bff204687d725b11c7795d89414ca6b155
                                                                                            • Instruction Fuzzy Hash: B0B17D71A50309AFEB14DF69CD89FAE7BA9EB08710F008159F915E72A0D770ED50CBA0
                                                                                            Function 00DD4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00DD4AED
                                                                                            • GetDriveTypeW.KERNEL32(?,00DFCB68,?,\\.\,00DFCC08), ref: 00DD4BCA
                                                                                            • SetErrorMode.KERNEL32(00000000,00DFCB68,?,\\.\,00DFCC08), ref: 00DD4D36
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$DriveType
                                                                                            • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                            • API String ID: 2907320926-4222207086
                                                                                            • Opcode ID: dcef173b55470fcb65f4923c7853c9d9b2f80e2b5acee6501c4ccf2a10977fff
                                                                                            • Instruction ID: 02b872d4af2d2dca04386cc038283bd8816394f288b8e215eb054194cd19f148
                                                                                            • Opcode Fuzzy Hash: dcef173b55470fcb65f4923c7853c9d9b2f80e2b5acee6501c4ccf2a10977fff
                                                                                            • Instruction Fuzzy Hash: 8F61CE3065620ADBCB04EF28DA82D78B7B1EF44304B289517F846AB391DB32ED45DB71
                                                                                            Function 00DF73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSysColor.USER32(00000012), ref: 00DF7421
                                                                                            • SetTextColor.GDI32(?,?), ref: 00DF7425
                                                                                            • GetSysColorBrush.USER32(0000000F), ref: 00DF743B
                                                                                            • GetSysColor.USER32(0000000F), ref: 00DF7446
                                                                                            • CreateSolidBrush.GDI32(?), ref: 00DF744B
                                                                                            • GetSysColor.USER32(00000011), ref: 00DF7463
                                                                                            • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DF7471
                                                                                            • SelectObject.GDI32(?,00000000), ref: 00DF7482
                                                                                            • SetBkColor.GDI32(?,00000000), ref: 00DF748B
                                                                                            • SelectObject.GDI32(?,?), ref: 00DF7498
                                                                                            • InflateRect.USER32(?,000000FF,000000FF), ref: 00DF74B7
                                                                                            • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DF74CE
                                                                                            • GetWindowLongW.USER32(00000000,000000F0), ref: 00DF74DB
                                                                                            • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DF752A
                                                                                            • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00DF7554
                                                                                            • InflateRect.USER32(?,000000FD,000000FD), ref: 00DF7572
                                                                                            • DrawFocusRect.USER32(?,?), ref: 00DF757D
                                                                                            • GetSysColor.USER32(00000011), ref: 00DF758E
                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00DF7596
                                                                                            • DrawTextW.USER32(?,00DF70F5,000000FF,?,00000000), ref: 00DF75A8
                                                                                            • SelectObject.GDI32(?,?), ref: 00DF75BF
                                                                                            • DeleteObject.GDI32(?), ref: 00DF75CA
                                                                                            • SelectObject.GDI32(?,?), ref: 00DF75D0
                                                                                            • DeleteObject.GDI32(?), ref: 00DF75D5
                                                                                            • SetTextColor.GDI32(?,?), ref: 00DF75DB
                                                                                            • SetBkColor.GDI32(?,?), ref: 00DF75E5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                            • String ID:
                                                                                            • API String ID: 1996641542-0
                                                                                            • Opcode ID: a6f96f81d35349bf8497ed3c96dff3f96fccbf692a2f7ae081627d21b1ceb4a9
                                                                                            • Instruction ID: 526805bd98377d2fbf2299bb13d9f926de5349b46bd612f5d52d688099dc00ae
                                                                                            • Opcode Fuzzy Hash: a6f96f81d35349bf8497ed3c96dff3f96fccbf692a2f7ae081627d21b1ceb4a9
                                                                                            • Instruction Fuzzy Hash: 03615A7290421CBFDB019FA4DD49EEEBFB9EB08320F159115FA15EB2A1D7709950CBA0
                                                                                            Function 00DF0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCursorPos.USER32(?), ref: 00DF1128
                                                                                            • GetDesktopWindow.USER32 ref: 00DF113D
                                                                                            • GetWindowRect.USER32(00000000), ref: 00DF1144
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF1199
                                                                                            • DestroyWindow.USER32(?), ref: 00DF11B9
                                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00DF11ED
                                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DF120B
                                                                                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00DF121D
                                                                                            • SendMessageW.USER32(00000000,00000421,?,?), ref: 00DF1232
                                                                                            • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00DF1245
                                                                                            • IsWindowVisible.USER32(00000000), ref: 00DF12A1
                                                                                            • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00DF12BC
                                                                                            • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00DF12D0
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00DF12E8
                                                                                            • MonitorFromPoint.USER32(?,?,00000002), ref: 00DF130E
                                                                                            • GetMonitorInfoW.USER32(00000000,?), ref: 00DF1328
                                                                                            • CopyRect.USER32(?,?), ref: 00DF133F
                                                                                            • SendMessageW.USER32(00000000,00000412,00000000), ref: 00DF13AA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                            • String ID: ($0$tooltips_class32
                                                                                            • API String ID: 698492251-4156429822
                                                                                            • Opcode ID: d7a064b12fe7b35ee4ae7386233e6873b5f493295377a7e80733e046774d2b0f
                                                                                            • Instruction ID: c89b97e5c639c4e7d8ba975761185e1e6608a1188405f09a6b102868053ed609
                                                                                            • Opcode Fuzzy Hash: d7a064b12fe7b35ee4ae7386233e6873b5f493295377a7e80733e046774d2b0f
                                                                                            • Instruction Fuzzy Hash: 34B18A71608345EFD700DF64C985BAABBE4FF84354F048919FA99DB2A1CB71E844CBA1
                                                                                            Function 00D78891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D78968
                                                                                            • GetSystemMetrics.USER32(00000007), ref: 00D78970
                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D7899B
                                                                                            • GetSystemMetrics.USER32(00000008), ref: 00D789A3
                                                                                            • GetSystemMetrics.USER32(00000004), ref: 00D789C8
                                                                                            • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D789E5
                                                                                            • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D789F5
                                                                                            • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D78A28
                                                                                            • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D78A3C
                                                                                            • GetClientRect.USER32(00000000,000000FF), ref: 00D78A5A
                                                                                            • GetStockObject.GDI32(00000011), ref: 00D78A76
                                                                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00D78A81
                                                                                              • Part of subcall function 00D7912D: GetCursorPos.USER32(?), ref: 00D79141
                                                                                              • Part of subcall function 00D7912D: ScreenToClient.USER32(00000000,?), ref: 00D7915E
                                                                                              • Part of subcall function 00D7912D: GetAsyncKeyState.USER32(00000001), ref: 00D79183
                                                                                              • Part of subcall function 00D7912D: GetAsyncKeyState.USER32(00000002), ref: 00D7919D
                                                                                            • SetTimer.USER32(00000000,00000000,00000028,00D790FC), ref: 00D78AA8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                            • String ID: AutoIt v3 GUI
                                                                                            • API String ID: 1458621304-248962490
                                                                                            • Opcode ID: 622c8cd7e292717a57ccfe50bb67a56ca1ed8187a5157fdbd66fe5dbfbbc475a
                                                                                            • Instruction ID: c9509c3abcb2c1a3b1779c5c29b28be60d84fc4ee25b79fed1280c80a5ef09f1
                                                                                            • Opcode Fuzzy Hash: 622c8cd7e292717a57ccfe50bb67a56ca1ed8187a5157fdbd66fe5dbfbbc475a
                                                                                            • Instruction Fuzzy Hash: FEB16B71A00209DFDB14DF68C949BAA7BB5FB48314F148229FA16E7290DB34E950CF61
                                                                                            Function 00DC0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DC1114
                                                                                              • Part of subcall function 00DC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1120
                                                                                              • Part of subcall function 00DC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC112F
                                                                                              • Part of subcall function 00DC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1136
                                                                                              • Part of subcall function 00DC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DC114D
                                                                                            • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DC0DF5
                                                                                            • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DC0E29
                                                                                            • GetLengthSid.ADVAPI32(?), ref: 00DC0E40
                                                                                            • GetAce.ADVAPI32(?,00000000,?), ref: 00DC0E7A
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DC0E96
                                                                                            • GetLengthSid.ADVAPI32(?), ref: 00DC0EAD
                                                                                            • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DC0EB5
                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00DC0EBC
                                                                                            • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DC0EDD
                                                                                            • CopySid.ADVAPI32(00000000), ref: 00DC0EE4
                                                                                            • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DC0F13
                                                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DC0F35
                                                                                            • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DC0F47
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0F6E
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0F75
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0F7E
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0F85
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC0F8E
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0F95
                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00DC0FA1
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC0FA8
                                                                                              • Part of subcall function 00DC1193: GetProcessHeap.KERNEL32(00000008,00DC0BB1,?,00000000,?,00DC0BB1,?), ref: 00DC11A1
                                                                                              • Part of subcall function 00DC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DC0BB1,?), ref: 00DC11A8
                                                                                              • Part of subcall function 00DC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DC0BB1,?), ref: 00DC11B7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                                            • String ID:
                                                                                            • API String ID: 4175595110-0
                                                                                            • Opcode ID: 3f5cf8d6d858166d42e75e391c42ba647e71d8d569030a79b28167cc61181380
                                                                                            • Instruction ID: c80887672215e3cad5a5e9c1f68c639f83aca10799b61b04c5ceaa1b57a631a8
                                                                                            • Opcode Fuzzy Hash: 3f5cf8d6d858166d42e75e391c42ba647e71d8d569030a79b28167cc61181380
                                                                                            • Instruction Fuzzy Hash: C8714A7290431AEBDF209FA4DD44FAEBBB8AF05300F188119F919E7291D7319A55CB70
                                                                                            Function 00DEC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DEC4BD
                                                                                            • RegCreateKeyExW.ADVAPI32(?,?,00000000,00DFCC08,00000000,?,00000000,?,?), ref: 00DEC544
                                                                                            • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00DEC5A4
                                                                                            • _wcslen.LIBCMT ref: 00DEC5F4
                                                                                            • _wcslen.LIBCMT ref: 00DEC66F
                                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00DEC6B2
                                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00DEC7C1
                                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00DEC84D
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00DEC881
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEC88E
                                                                                            • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00DEC960
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                                            • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                            • API String ID: 9721498-966354055
                                                                                            • Opcode ID: 26f5902c39a419fc891de4e7376b9ba7346f0d83b657ad5e64e96ffd567e871e
                                                                                            • Instruction ID: 208dbdbc1f85e4e664c09dd66a85f3426b6cf22a3e1eec14dcd7274ac08b0db4
                                                                                            • Opcode Fuzzy Hash: 26f5902c39a419fc891de4e7376b9ba7346f0d83b657ad5e64e96ffd567e871e
                                                                                            • Instruction Fuzzy Hash: 6E127F356142419FD714EF15C881A2AB7E5FF88714F18889DF88A9B3A2DB31FD41CBA1
                                                                                            Function 00DF091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CharUpperBuffW.USER32(?,?), ref: 00DF09C6
                                                                                            • _wcslen.LIBCMT ref: 00DF0A01
                                                                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DF0A54
                                                                                            • _wcslen.LIBCMT ref: 00DF0A8A
                                                                                            • _wcslen.LIBCMT ref: 00DF0B06
                                                                                            • _wcslen.LIBCMT ref: 00DF0B81
                                                                                              • Part of subcall function 00D7F9F2: _wcslen.LIBCMT ref: 00D7F9FD
                                                                                              • Part of subcall function 00DC2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DC2BFA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                            • API String ID: 1103490817-4258414348
                                                                                            • Opcode ID: 863be8878470c55b3f4451ab8dcbaf65a548789171a6f78b74aa6aa36e167ae7
                                                                                            • Instruction ID: 0f956011d81b598f211183b9b19280f5b0c6f5cbcf470f3abd71448f91c4937f
                                                                                            • Opcode Fuzzy Hash: 863be8878470c55b3f4451ab8dcbaf65a548789171a6f78b74aa6aa36e167ae7
                                                                                            • Instruction Fuzzy Hash: DDE179352083059FC714DF24C45193ABBE2FF98318B1A895DF99AAB362D730ED45CBA1
                                                                                            Function 00DEC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$BuffCharUpper
                                                                                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                            • API String ID: 1256254125-909552448
                                                                                            • Opcode ID: f5c9b6e694699937d150362b021dd64b63d5b9c201a10dcfa56bdd226467a3a9
                                                                                            • Instruction ID: 3affbd3d70b3c074418024d4afc0457fa3b7f527a4a47de8255e1ad2fb39a9db
                                                                                            • Opcode Fuzzy Hash: f5c9b6e694699937d150362b021dd64b63d5b9c201a10dcfa56bdd226467a3a9
                                                                                            • Instruction Fuzzy Hash: 0E711D326201AA4BCB20FE7EDD525BF33959F60754B292139FCA5A7244E631CD46C770
                                                                                            Function 00DF833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00DF835A
                                                                                            • _wcslen.LIBCMT ref: 00DF836E
                                                                                            • _wcslen.LIBCMT ref: 00DF8391
                                                                                            • _wcslen.LIBCMT ref: 00DF83B4
                                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00DF83F2
                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00DF361A,?), ref: 00DF844E
                                                                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DF8487
                                                                                            • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00DF84CA
                                                                                            • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DF8501
                                                                                            • FreeLibrary.KERNEL32(?), ref: 00DF850D
                                                                                            • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DF851D
                                                                                            • DestroyIcon.USER32(?), ref: 00DF852C
                                                                                            • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00DF8549
                                                                                            • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00DF8555
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                                            • String ID: .dll$.exe$.icl
                                                                                            • API String ID: 799131459-1154884017
                                                                                            • Opcode ID: 292bc4e8b5c17e4340c6f13aa4d5ea15ff7e25e8dfc9442566f3be6bf8045c28
                                                                                            • Instruction ID: db2f2b579cbae764a7e44f45f16ec526e0f582a0b2cefc8a25c2a35a9079c132
                                                                                            • Opcode Fuzzy Hash: 292bc4e8b5c17e4340c6f13aa4d5ea15ff7e25e8dfc9442566f3be6bf8045c28
                                                                                            • Instruction Fuzzy Hash: 0361DF7155031ABBEB14DF64CC41BBE77A8FB04721F10860AF915EA2D1DB74AA90DBB0
                                                                                            Function 00D67778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                            • API String ID: 0-1645009161
                                                                                            • Opcode ID: 6987e418752812bd93f661bb473f6e765824902d4e398fa021477b15c8ff2ba5
                                                                                            • Instruction ID: ea63d010b1d75c346c0a59edcdd7c557f41acb41edcccaa0e2af9ce03d3b46e2
                                                                                            • Opcode Fuzzy Hash: 6987e418752812bd93f661bb473f6e765824902d4e398fa021477b15c8ff2ba5
                                                                                            • Instruction Fuzzy Hash: 28810471A04209BFDB21AF60DC42FBE77A8EF15304F184025F904AB196EB71DA15DBB5
                                                                                            Function 00DD3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CharLowerBuffW.USER32(?,?), ref: 00DD3EF8
                                                                                            • _wcslen.LIBCMT ref: 00DD3F03
                                                                                            • _wcslen.LIBCMT ref: 00DD3F5A
                                                                                            • _wcslen.LIBCMT ref: 00DD3F98
                                                                                            • GetDriveTypeW.KERNEL32(?), ref: 00DD3FD6
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DD401E
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DD4059
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DD4087
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                            • API String ID: 1839972693-4113822522
                                                                                            • Opcode ID: 3f5f489622bf153daff85dd251e167b8fb5ac42b54d632d6a08e5d92c369cf76
                                                                                            • Instruction ID: 408d31b44625c7e35db0e13dd9fb8793bc062517a294c6d665884916ad2ab43c
                                                                                            • Opcode Fuzzy Hash: 3f5f489622bf153daff85dd251e167b8fb5ac42b54d632d6a08e5d92c369cf76
                                                                                            • Instruction Fuzzy Hash: 77719D726042159FC710EF24C88186AB7F4EF94758F144A2EF89697351EB31ED45CBB2
                                                                                            Function 00DC5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadIconW.USER32(00000063), ref: 00DC5A2E
                                                                                            • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DC5A40
                                                                                            • SetWindowTextW.USER32(?,?), ref: 00DC5A57
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00DC5A6C
                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00DC5A72
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00DC5A82
                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00DC5A88
                                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00DC5AA9
                                                                                            • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00DC5AC3
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DC5ACC
                                                                                            • _wcslen.LIBCMT ref: 00DC5B33
                                                                                            • SetWindowTextW.USER32(?,?), ref: 00DC5B6F
                                                                                            • GetDesktopWindow.USER32 ref: 00DC5B75
                                                                                            • GetWindowRect.USER32(00000000), ref: 00DC5B7C
                                                                                            • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00DC5BD3
                                                                                            • GetClientRect.USER32(?,?), ref: 00DC5BE0
                                                                                            • PostMessageW.USER32(?,00000005,00000000,?), ref: 00DC5C05
                                                                                            • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00DC5C2F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 895679908-0
                                                                                            • Opcode ID: c93b84ba86f7763b7e5f4f9fb5d127e8b7c17216eb2e92c47909d2cb8b5a9806
                                                                                            • Instruction ID: ad394e5c1294bcd2cef47aab10fbfc3278b25c511c8411fb60ece16ff6725933
                                                                                            • Opcode Fuzzy Hash: c93b84ba86f7763b7e5f4f9fb5d127e8b7c17216eb2e92c47909d2cb8b5a9806
                                                                                            • Instruction Fuzzy Hash: 73715931900B0AAFDB209FA9DE45FAEBBF5EB48704F14451CE582E36A4D771B954CB20
                                                                                            Function 00DDFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadCursorW.USER32(00000000,00007F89), ref: 00DDFE27
                                                                                            • LoadCursorW.USER32(00000000,00007F8A), ref: 00DDFE32
                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00DDFE3D
                                                                                            • LoadCursorW.USER32(00000000,00007F03), ref: 00DDFE48
                                                                                            • LoadCursorW.USER32(00000000,00007F8B), ref: 00DDFE53
                                                                                            • LoadCursorW.USER32(00000000,00007F01), ref: 00DDFE5E
                                                                                            • LoadCursorW.USER32(00000000,00007F81), ref: 00DDFE69
                                                                                            • LoadCursorW.USER32(00000000,00007F88), ref: 00DDFE74
                                                                                            • LoadCursorW.USER32(00000000,00007F80), ref: 00DDFE7F
                                                                                            • LoadCursorW.USER32(00000000,00007F86), ref: 00DDFE8A
                                                                                            • LoadCursorW.USER32(00000000,00007F83), ref: 00DDFE95
                                                                                            • LoadCursorW.USER32(00000000,00007F85), ref: 00DDFEA0
                                                                                            • LoadCursorW.USER32(00000000,00007F82), ref: 00DDFEAB
                                                                                            • LoadCursorW.USER32(00000000,00007F84), ref: 00DDFEB6
                                                                                            • LoadCursorW.USER32(00000000,00007F04), ref: 00DDFEC1
                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00DDFECC
                                                                                            • GetCursorInfo.USER32(?), ref: 00DDFEDC
                                                                                            • GetLastError.KERNEL32 ref: 00DDFF1E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Cursor$Load$ErrorInfoLast
                                                                                            • String ID:
                                                                                            • API String ID: 3215588206-0
                                                                                            • Opcode ID: 8c409beb920e6ff2692d70eca75ca2a6f5a24b49cf27579f9979edd179b3ccc1
                                                                                            • Instruction ID: 5cc503d44314ebe2655953edc8351cde857edef60ef72e5474989770c387fd1d
                                                                                            • Opcode Fuzzy Hash: 8c409beb920e6ff2692d70eca75ca2a6f5a24b49cf27579f9979edd179b3ccc1
                                                                                            • Instruction Fuzzy Hash: DD4154B0D08319ABDB109FBA8C8586EBFE8FF04354B54452AE11DE7281DB78D905CEA1
                                                                                            Function 00DC30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[
                                                                                            • API String ID: 176396367-1901692981
                                                                                            • Opcode ID: 278b3cb6c9d08189845b24f6913b6a175e14f60c7c3e676ed5473d585dd53364
                                                                                            • Instruction ID: 4f3285a5230b84bf56fcb400a8f5886a9e8125d5951799281cc9acdaef61e4d6
                                                                                            • Opcode Fuzzy Hash: 278b3cb6c9d08189845b24f6913b6a175e14f60c7c3e676ed5473d585dd53364
                                                                                            • Instruction Fuzzy Hash: FAE17132A04627ABCB189FA8C451BEDFBA5FF54710F58C11EE456B7240DB30AE459BB0
                                                                                            Function 00D800C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00D800C6
                                                                                              • Part of subcall function 00D800ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00E3070C,00000FA0,CF57211C,?,?,?,?,00DA23B3,000000FF), ref: 00D8011C
                                                                                              • Part of subcall function 00D800ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00DA23B3,000000FF), ref: 00D80127
                                                                                              • Part of subcall function 00D800ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00DA23B3,000000FF), ref: 00D80138
                                                                                              • Part of subcall function 00D800ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00D8014E
                                                                                              • Part of subcall function 00D800ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D8015C
                                                                                              • Part of subcall function 00D800ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D8016A
                                                                                              • Part of subcall function 00D800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D80195
                                                                                              • Part of subcall function 00D800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D801A0
                                                                                            • ___scrt_fastfail.LIBCMT ref: 00D800E7
                                                                                              • Part of subcall function 00D800A3: __onexit.LIBCMT ref: 00D800A9
                                                                                            Strings
                                                                                            • SleepConditionVariableCS, xrefs: 00D80154
                                                                                            • InitializeConditionVariable, xrefs: 00D80148
                                                                                            • kernel32.dll, xrefs: 00D80133
                                                                                            • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D80122
                                                                                            • WakeAllConditionVariable, xrefs: 00D80162
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                                            • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                            • API String ID: 66158676-1714406822
                                                                                            • Opcode ID: a5b3358d8c05f3d4ec92c02ab60e0b0f3673c5fa0800714b869c95306d97ad16
                                                                                            • Instruction ID: 637bca5ffcdd818b3fefdbe3d21d4241338e9b57de975ac461b923523753b59e
                                                                                            • Opcode Fuzzy Hash: a5b3358d8c05f3d4ec92c02ab60e0b0f3673c5fa0800714b869c95306d97ad16
                                                                                            • Instruction Fuzzy Hash: CE21F932A447196FE7607B64AD4DB3D3B98DF05BA1F05812AF905E6391DBA09808CBB0
                                                                                            Function 00DD44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CharLowerBuffW.USER32(00000000,00000000,00DFCC08), ref: 00DD4527
                                                                                            • _wcslen.LIBCMT ref: 00DD453B
                                                                                            • _wcslen.LIBCMT ref: 00DD4599
                                                                                            • _wcslen.LIBCMT ref: 00DD45F4
                                                                                            • _wcslen.LIBCMT ref: 00DD463F
                                                                                            • _wcslen.LIBCMT ref: 00DD46A7
                                                                                              • Part of subcall function 00D7F9F2: _wcslen.LIBCMT ref: 00D7F9FD
                                                                                            • GetDriveTypeW.KERNEL32(?,00E26BF0,00000061), ref: 00DD4743
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$BuffCharDriveLowerType
                                                                                            • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                            • API String ID: 2055661098-1000479233
                                                                                            • Opcode ID: 2e3ac635946369f814edaa3f8200d408f2a001434b4024eb6062d9dbd9d6d909
                                                                                            • Instruction ID: aa904ac0851358dd6d7ec9b2e189e87975fc9abc5f43ffba8020506e054b4e30
                                                                                            • Opcode Fuzzy Hash: 2e3ac635946369f814edaa3f8200d408f2a001434b4024eb6062d9dbd9d6d909
                                                                                            • Instruction Fuzzy Hash: AFB1C0316083029FC710DF28D891AAAB7E5EFA5764F548A1EF49AD7391D730D844CBB2
                                                                                            Function 00DF911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • DragQueryPoint.SHELL32(?,?), ref: 00DF9147
                                                                                              • Part of subcall function 00DF7674: ClientToScreen.USER32(?,?), ref: 00DF769A
                                                                                              • Part of subcall function 00DF7674: GetWindowRect.USER32(?,?), ref: 00DF7710
                                                                                              • Part of subcall function 00DF7674: PtInRect.USER32(?,?,00DF8B89), ref: 00DF7720
                                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00DF91B0
                                                                                            • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00DF91BB
                                                                                            • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00DF91DE
                                                                                            • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00DF9225
                                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00DF923E
                                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00DF9255
                                                                                            • SendMessageW.USER32(?,000000B1,?,?), ref: 00DF9277
                                                                                            • DragFinish.SHELL32(?), ref: 00DF927E
                                                                                            • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00DF9371
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#
                                                                                            • API String ID: 221274066-136824727
                                                                                            • Opcode ID: 9c159e63fe215af89a3ccc9d18fe3cbda4ad1956e27f1a10001c5adf7987c5d8
                                                                                            • Instruction ID: 62ebe1bccc31c73358ca350a3fda1341d2efc1ff9b4ce6cb4446b0c9fda43f60
                                                                                            • Opcode Fuzzy Hash: 9c159e63fe215af89a3ccc9d18fe3cbda4ad1956e27f1a10001c5adf7987c5d8
                                                                                            • Instruction Fuzzy Hash: E4617971508305AFC701DF64DD95EAFBBE8EF88750F40492EF595922A0DB309A49CB72
                                                                                            Function 00DEAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00DEB198
                                                                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DEB1B0
                                                                                            • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DEB1D4
                                                                                            • _wcslen.LIBCMT ref: 00DEB200
                                                                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DEB214
                                                                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DEB236
                                                                                            • _wcslen.LIBCMT ref: 00DEB332
                                                                                              • Part of subcall function 00DD05A7: GetStdHandle.KERNEL32(000000F6), ref: 00DD05C6
                                                                                            • _wcslen.LIBCMT ref: 00DEB34B
                                                                                            • _wcslen.LIBCMT ref: 00DEB366
                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DEB3B6
                                                                                            • GetLastError.KERNEL32(00000000), ref: 00DEB407
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DEB439
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEB44A
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEB45C
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEB46E
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DEB4E3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                                            • String ID:
                                                                                            • API String ID: 2178637699-0
                                                                                            • Opcode ID: 94be399e16ef7ad03fa4c7fd0195015eb08134053bd4ce69b064a6a258a774c2
                                                                                            • Instruction ID: f057385532456fe8780f131aab0e3f54e57d4063e1a9037354aead567a394e98
                                                                                            • Opcode Fuzzy Hash: 94be399e16ef7ad03fa4c7fd0195015eb08134053bd4ce69b064a6a258a774c2
                                                                                            • Instruction Fuzzy Hash: BBF14A315082409FC725EF25C891B6BBBE5EF85324F18855EF4999B2A2DB31EC44CB72
                                                                                            Function 00DE3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,00DFCC08), ref: 00DE40BB
                                                                                            • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00DE40CD
                                                                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00DFCC08), ref: 00DE40F2
                                                                                            • FreeLibrary.KERNEL32(00000000,?,00DFCC08), ref: 00DE413E
                                                                                            • StringFromGUID2.OLE32(?,?,00000028,?,00DFCC08), ref: 00DE41A8
                                                                                            • SysFreeString.OLEAUT32(00000009), ref: 00DE4262
                                                                                            • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00DE42C8
                                                                                            • SysFreeString.OLEAUT32(?), ref: 00DE42F2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                                            • String ID: GetModuleHandleExW$kernel32.dll
                                                                                            • API String ID: 354098117-199464113
                                                                                            • Opcode ID: 01757f499dd847a9a90fe28fed7f4ba0e089e82a6826c53452f0822dc5827340
                                                                                            • Instruction ID: f92d6145ce43ab47f042e7faf0f13ad9bb6232fa5eabd560da1fb4e38a67791e
                                                                                            • Opcode Fuzzy Hash: 01757f499dd847a9a90fe28fed7f4ba0e089e82a6826c53452f0822dc5827340
                                                                                            • Instruction Fuzzy Hash: 66125B75A00249EFDB14EF95C884EAEB7B9FF45314F288098F905AB251C771ED46CBA0
                                                                                            Function 00D6326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemCount.USER32(00E31990), ref: 00DA2F8D
                                                                                            • GetMenuItemCount.USER32(00E31990), ref: 00DA303D
                                                                                            • GetCursorPos.USER32(?), ref: 00DA3081
                                                                                            • SetForegroundWindow.USER32(00000000), ref: 00DA308A
                                                                                            • TrackPopupMenuEx.USER32(00E31990,00000000,?,00000000,00000000,00000000), ref: 00DA309D
                                                                                            • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DA30A9
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                                            • String ID: 0
                                                                                            • API String ID: 36266755-4108050209
                                                                                            • Opcode ID: 4ca8a042ed482aa1c1f273942f4c771e3b01f16c61386976dfa44754812f6c9d
                                                                                            • Instruction ID: 3d81d4efc01ab118d10f24efacf32b2d3a6ee6f764910bfaad6efa03894659b3
                                                                                            • Opcode Fuzzy Hash: 4ca8a042ed482aa1c1f273942f4c771e3b01f16c61386976dfa44754812f6c9d
                                                                                            • Instruction Fuzzy Hash: F6713930644209BFEB218F2ACD49FBABF65FF05324F244206F515AA2E0C7B1A954DB70
                                                                                            Function 00DF6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(00000000,?), ref: 00DF6DEB
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00DF6E5F
                                                                                            • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00DF6E81
                                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DF6E94
                                                                                            • DestroyWindow.USER32(?), ref: 00DF6EB5
                                                                                            • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D60000,00000000), ref: 00DF6EE4
                                                                                            • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DF6EFD
                                                                                            • GetDesktopWindow.USER32 ref: 00DF6F16
                                                                                            • GetWindowRect.USER32(00000000), ref: 00DF6F1D
                                                                                            • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00DF6F35
                                                                                            • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00DF6F4D
                                                                                              • Part of subcall function 00D79944: GetWindowLongW.USER32(?,000000EB), ref: 00D79952
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                                            • String ID: 0$tooltips_class32
                                                                                            • API String ID: 2429346358-3619404913
                                                                                            • Opcode ID: 472a6ed8d5b1fc740e2d4907113854db1c3dbeced4eff40c9e9933a8b3852160
                                                                                            • Instruction ID: 6bd53b04b3f3498c20c1078e918c53e5f2bd9dfb8f54df8929e344bdacda794c
                                                                                            • Opcode Fuzzy Hash: 472a6ed8d5b1fc740e2d4907113854db1c3dbeced4eff40c9e9933a8b3852160
                                                                                            • Instruction Fuzzy Hash: 18716B71104348AFDB21CF18D848B7ABBE9EF89304F08841DFA99D7661D770E909CB21
                                                                                            Function 00DDC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DDC4B0
                                                                                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DDC4C3
                                                                                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DDC4D7
                                                                                            • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00DDC4F0
                                                                                            • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00DDC533
                                                                                            • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00DDC549
                                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DDC554
                                                                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DDC584
                                                                                            • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DDC5DC
                                                                                            • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DDC5F0
                                                                                            • InternetCloseHandle.WININET(00000000), ref: 00DDC5FB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                                            • String ID:
                                                                                            • API String ID: 3800310941-3916222277
                                                                                            • Opcode ID: 7b1860af370b9deb15ca69233e7903ddb2e98b7d944f322703f789ae9b689cd4
                                                                                            • Instruction ID: 8abd332c0467316df3dc6d9df5a76410e61b69b1a85f2c5cc39191051d4983a6
                                                                                            • Opcode Fuzzy Hash: 7b1860af370b9deb15ca69233e7903ddb2e98b7d944f322703f789ae9b689cd4
                                                                                            • Instruction Fuzzy Hash: 9F514AB151030ABFDB219FA0D988ABA7BBCEB08754F04941AF946D6710EB30E954DB70
                                                                                            Function 00DF856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00DF8592
                                                                                            • GetFileSize.KERNEL32(00000000,00000000), ref: 00DF85A2
                                                                                            • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00DF85AD
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DF85BA
                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00DF85C8
                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00DF85D7
                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00DF85E0
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DF85E7
                                                                                            • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00DF85F8
                                                                                            • OleLoadPicture.OLEAUT32(?,00000000,00000000,00DFFC38,?), ref: 00DF8611
                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00DF8621
                                                                                            • GetObjectW.GDI32(?,00000018,000000FF), ref: 00DF8641
                                                                                            • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00DF8671
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DF8699
                                                                                            • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00DF86AF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                            • String ID:
                                                                                            • API String ID: 3840717409-0
                                                                                            • Opcode ID: 5dd634c2daa64869a13ee8884a55787b7de0266c91e8e23ec4097fb66e82ef7b
                                                                                            • Instruction ID: 0e68526861c46b8753a54020a40a7aab95dadd923cbcc9c24c95cd03d288f0de
                                                                                            • Opcode Fuzzy Hash: 5dd634c2daa64869a13ee8884a55787b7de0266c91e8e23ec4097fb66e82ef7b
                                                                                            • Instruction Fuzzy Hash: B7411875600308AFDB119FA5CD48EBA7BB8EF89711F158058F905EB260DB309911DB30
                                                                                            Function 00DD14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(00000000), ref: 00DD1502
                                                                                            • VariantCopy.OLEAUT32(?,?), ref: 00DD150B
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DD1517
                                                                                            • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00DD15FB
                                                                                            • VarR8FromDec.OLEAUT32(?,?), ref: 00DD1657
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DD1708
                                                                                            • SysFreeString.OLEAUT32(?), ref: 00DD178C
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DD17D8
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DD17E7
                                                                                            • VariantInit.OLEAUT32(00000000), ref: 00DD1823
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                                                            • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                            • API String ID: 1234038744-3931177956
                                                                                            • Opcode ID: 7a8648b10fb707a7a4c21fb05a876cc87ee64fad0b9f92a2411b0f899c26eb06
                                                                                            • Instruction ID: 76f28d80c143b9beef26f92dac4cba7f610bd6476ab8df81b8a000d213231324
                                                                                            • Opcode Fuzzy Hash: 7a8648b10fb707a7a4c21fb05a876cc87ee64fad0b9f92a2411b0f899c26eb06
                                                                                            • Instruction Fuzzy Hash: 91D1EC79A00205FBDB109F65E884B79B7B5FF45700F14845BE886AB290DB38EC54DBB2
                                                                                            Function 00DEB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DEB6AE,?,?), ref: 00DEC9B5
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DEC9F1
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA68
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA9E
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DEB6F4
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DEB772
                                                                                            • RegDeleteValueW.ADVAPI32(?,?), ref: 00DEB80A
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00DEB87E
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00DEB89C
                                                                                            • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00DEB8F2
                                                                                            • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DEB904
                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00DEB922
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00DEB983
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEB994
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                            • API String ID: 146587525-4033151799
                                                                                            • Opcode ID: 3f83f2407ffbadb11e599485af3d74e34f2ef0fb192ecd9e723d9133935bba80
                                                                                            • Instruction ID: d3814fb581c0fb66817a8292fec35afd0f7ec6330a92f6b9ba608a2badcf37d3
                                                                                            • Opcode Fuzzy Hash: 3f83f2407ffbadb11e599485af3d74e34f2ef0fb192ecd9e723d9133935bba80
                                                                                            • Instruction Fuzzy Hash: 0CC17C30204241AFD714EF15C895F2ABBE5EF84318F18945DE49A8B7A2CB71EC46CFA1
                                                                                            Function 00DE255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDC.USER32(00000000), ref: 00DE25D8
                                                                                            • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00DE25E8
                                                                                            • CreateCompatibleDC.GDI32(?), ref: 00DE25F4
                                                                                            • SelectObject.GDI32(00000000,?), ref: 00DE2601
                                                                                            • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00DE266D
                                                                                            • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00DE26AC
                                                                                            • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00DE26D0
                                                                                            • SelectObject.GDI32(?,?), ref: 00DE26D8
                                                                                            • DeleteObject.GDI32(?), ref: 00DE26E1
                                                                                            • DeleteDC.GDI32(?), ref: 00DE26E8
                                                                                            • ReleaseDC.USER32(00000000,?), ref: 00DE26F3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                            • String ID: (
                                                                                            • API String ID: 2598888154-3887548279
                                                                                            • Opcode ID: b875a56e06f2d019b6cde765f571088b271e39cf2c6ce7b376425febcc54104d
                                                                                            • Instruction ID: eeb3559a9785d972f9aacbed4e453cba35e7efd6689640140ad91890ca1004d6
                                                                                            • Opcode Fuzzy Hash: b875a56e06f2d019b6cde765f571088b271e39cf2c6ce7b376425febcc54104d
                                                                                            • Instruction Fuzzy Hash: 1E61E175D00219EFCB04DFA8D984AAEBBB9FF48310F208529E955A7350E770A951CF60
                                                                                            Function 00D9DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___free_lconv_mon.LIBCMT ref: 00D9DAA1
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D659
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D66B
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D67D
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D68F
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6A1
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6B3
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6C5
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6D7
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6E9
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D6FB
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D70D
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D71F
                                                                                              • Part of subcall function 00D9D63C: _free.LIBCMT ref: 00D9D731
                                                                                            • _free.LIBCMT ref: 00D9DA96
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • _free.LIBCMT ref: 00D9DAB8
                                                                                            • _free.LIBCMT ref: 00D9DACD
                                                                                            • _free.LIBCMT ref: 00D9DAD8
                                                                                            • _free.LIBCMT ref: 00D9DAFA
                                                                                            • _free.LIBCMT ref: 00D9DB0D
                                                                                            • _free.LIBCMT ref: 00D9DB1B
                                                                                            • _free.LIBCMT ref: 00D9DB26
                                                                                            • _free.LIBCMT ref: 00D9DB5E
                                                                                            • _free.LIBCMT ref: 00D9DB65
                                                                                            • _free.LIBCMT ref: 00D9DB82
                                                                                            • _free.LIBCMT ref: 00D9DB9A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                            • String ID:
                                                                                            • API String ID: 161543041-0
                                                                                            • Opcode ID: 16455680226a2b7a2b9d9f7fc65bf06a3a5f250af0d64971ee149d4eaaa721ac
                                                                                            • Instruction ID: 5547ebd2fee9bdae4512335e105d136a14c54f5afbd0f91fac30ac476aa96023
                                                                                            • Opcode Fuzzy Hash: 16455680226a2b7a2b9d9f7fc65bf06a3a5f250af0d64971ee149d4eaaa721ac
                                                                                            • Instruction Fuzzy Hash: 1C317A31644304AFEF21AA39E845B6AB7EAFF10324F694529E449D7191DF31EC90CB70
                                                                                            Function 00DC365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00DC369C
                                                                                            • _wcslen.LIBCMT ref: 00DC36A7
                                                                                            • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00DC3797
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00DC380C
                                                                                            • GetDlgCtrlID.USER32(?), ref: 00DC385D
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DC3882
                                                                                            • GetParent.USER32(?), ref: 00DC38A0
                                                                                            • ScreenToClient.USER32(00000000), ref: 00DC38A7
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00DC3921
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00DC395D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                                                            • String ID: %s%u
                                                                                            • API String ID: 4010501982-679674701
                                                                                            • Opcode ID: 105ec893203dabfeb43bc80c027c7cb096fb468d3d1e71e98c4c1345567dcb64
                                                                                            • Instruction ID: d3915e97fa748be60140fe7d8fc91890d76e4e3b78ad848bcfff4ad57790828f
                                                                                            • Opcode Fuzzy Hash: 105ec893203dabfeb43bc80c027c7cb096fb468d3d1e71e98c4c1345567dcb64
                                                                                            • Instruction Fuzzy Hash: 85919A71204607AFDB19DE64C885FAAB7A8FF48350F04862DF999D3190DB30EA55CBB1
                                                                                            Function 00DC4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00DC4994
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00DC49DA
                                                                                            • _wcslen.LIBCMT ref: 00DC49EB
                                                                                            • CharUpperBuffW.USER32(?,00000000), ref: 00DC49F7
                                                                                            • _wcsstr.LIBVCRUNTIME ref: 00DC4A2C
                                                                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 00DC4A64
                                                                                            • GetWindowTextW.USER32(?,?,00000400), ref: 00DC4A9D
                                                                                            • GetClassNameW.USER32(00000018,?,00000400), ref: 00DC4AE6
                                                                                            • GetClassNameW.USER32(?,?,00000400), ref: 00DC4B20
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DC4B8B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                                            • String ID: ThumbnailClass
                                                                                            • API String ID: 1311036022-1241985126
                                                                                            • Opcode ID: 616dd16a0de5f94b95eef5adf7c7da8d4f7e0756b434dac256a028c69edf86c2
                                                                                            • Instruction ID: 4b89df967bbdd6ce2b8b45ca53c83d04df0e7abd538384ebb395155e2c15d21a
                                                                                            • Opcode Fuzzy Hash: 616dd16a0de5f94b95eef5adf7c7da8d4f7e0756b434dac256a028c69edf86c2
                                                                                            • Instruction Fuzzy Hash: 13919B7110820A9BDB04DF14C9A5FAAB7A9EF84314F08846DFD859B1A6DB30ED45CBB1
                                                                                            Function 00DCBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemInfoW.USER32(00E31990,000000FF,00000000,00000030), ref: 00DCBFAC
                                                                                            • SetMenuItemInfoW.USER32(00E31990,00000004,00000000,00000030), ref: 00DCBFE1
                                                                                            • Sleep.KERNEL32(000001F4), ref: 00DCBFF3
                                                                                            • GetMenuItemCount.USER32(?), ref: 00DCC039
                                                                                            • GetMenuItemID.USER32(?,00000000), ref: 00DCC056
                                                                                            • GetMenuItemID.USER32(?,-00000001), ref: 00DCC082
                                                                                            • GetMenuItemID.USER32(?,?), ref: 00DCC0C9
                                                                                            • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DCC10F
                                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DCC124
                                                                                            • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DCC145
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                                            • String ID: 0
                                                                                            • API String ID: 1460738036-4108050209
                                                                                            • Opcode ID: 83d11a4e9d8a1863655df58019ba120fc7ada1444ee82dd8d955b045394e56c3
                                                                                            • Instruction ID: 1d99518de47517da2bcb79e55223fd77b6256decb649a25dbc6f5aa6ccf84cf4
                                                                                            • Opcode Fuzzy Hash: 83d11a4e9d8a1863655df58019ba120fc7ada1444ee82dd8d955b045394e56c3
                                                                                            • Instruction Fuzzy Hash: 0B6168B092034AAFDF11CF64C988FAEBBA8EB05354F08505DEA49A3291D731AD15DB70
                                                                                            Function 00DECC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00DECC64
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00DECC8D
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00DECD48
                                                                                              • Part of subcall function 00DECC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00DECCAA
                                                                                              • Part of subcall function 00DECC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00DECCBD
                                                                                              • Part of subcall function 00DECC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DECCCF
                                                                                              • Part of subcall function 00DECC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00DECD05
                                                                                              • Part of subcall function 00DECC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00DECD28
                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00DECCF3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                            • API String ID: 2734957052-4033151799
                                                                                            • Opcode ID: a405c63e8e9efa3be281d6faf24bd98b94c2facd855fe80016d5ec2206835fa6
                                                                                            • Instruction ID: f8d6cb985f532d99ed84a2dd582e084ddfb94545bbc80b247b0795cdbee34088
                                                                                            • Opcode Fuzzy Hash: a405c63e8e9efa3be281d6faf24bd98b94c2facd855fe80016d5ec2206835fa6
                                                                                            • Instruction Fuzzy Hash: C4318D7191122DBBDB21AB56DC88EFFBB7CEF05740F045165B906E2240DB309A46DAB0
                                                                                            Function 00DD3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00DD3D40
                                                                                            • _wcslen.LIBCMT ref: 00DD3D6D
                                                                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00DD3D9D
                                                                                            • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00DD3DBE
                                                                                            • RemoveDirectoryW.KERNEL32(?), ref: 00DD3DCE
                                                                                            • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00DD3E55
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DD3E60
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DD3E6B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                                            • String ID: :$\$\??\%s
                                                                                            • API String ID: 1149970189-3457252023
                                                                                            • Opcode ID: badd065d6d3db97bef20084a192715cfd26a7ed82dec3785769963d98be44cf1
                                                                                            • Instruction ID: c9bdb9e11b05a43ca08047f0fb13107465fa5a0ae705ed1f8c87d3e5e681c6c8
                                                                                            • Opcode Fuzzy Hash: badd065d6d3db97bef20084a192715cfd26a7ed82dec3785769963d98be44cf1
                                                                                            • Instruction Fuzzy Hash: 4131AF72910209ABDB209BA0DC49FEB37BDEF89740F1081B6F509D62A0EB709754CB35
                                                                                            Function 00DCE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • timeGetTime.WINMM ref: 00DCE6B4
                                                                                              • Part of subcall function 00D7E551: timeGetTime.WINMM(?,?,00DCE6D4), ref: 00D7E555
                                                                                            • Sleep.KERNEL32(0000000A), ref: 00DCE6E1
                                                                                            • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00DCE705
                                                                                            • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00DCE727
                                                                                            • SetActiveWindow.USER32 ref: 00DCE746
                                                                                            • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00DCE754
                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 00DCE773
                                                                                            • Sleep.KERNEL32(000000FA), ref: 00DCE77E
                                                                                            • IsWindow.USER32 ref: 00DCE78A
                                                                                            • EndDialog.USER32(00000000), ref: 00DCE79B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                            • String ID: BUTTON
                                                                                            • API String ID: 1194449130-3405671355
                                                                                            • Opcode ID: 8ac6d06e86b4bead9d27b9d8af8f154bece759473fbb714121e59784106be0a5
                                                                                            • Instruction ID: 5551bb5fcb96836b1e62993d977ad95c5f5734b9a08aba44bb74800fcc1c4477
                                                                                            • Opcode Fuzzy Hash: 8ac6d06e86b4bead9d27b9d8af8f154bece759473fbb714121e59784106be0a5
                                                                                            • Instruction Fuzzy Hash: 79218EB121070AAFEB005F62ED8EF353F69EB54348B14A42CF545D22B1DB71AC28DA34
                                                                                            Function 00DCE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00DCEA5D
                                                                                            • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00DCEA73
                                                                                            • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DCEA84
                                                                                            • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00DCEA96
                                                                                            • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00DCEAA7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: SendString$_wcslen
                                                                                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                            • API String ID: 2420728520-1007645807
                                                                                            • Opcode ID: fc0b4d1d9e8821963e9c94102877b01432890db9f64d8ca1e66fbb826393cb2e
                                                                                            • Instruction ID: cfcdb16fbd67fa10d51ea4ee22b0a743d978586031756ac7fb9dc0aedf3bc479
                                                                                            • Opcode Fuzzy Hash: fc0b4d1d9e8821963e9c94102877b01432890db9f64d8ca1e66fbb826393cb2e
                                                                                            • Instruction Fuzzy Hash: A4117371A903697ED720A7A6EC4AEFF6B7CEBD2B00F4415297401E30D1EEB05945C9B0
                                                                                            Function 00DC9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?), ref: 00DCA012
                                                                                            • SetKeyboardState.USER32(?), ref: 00DCA07D
                                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00DCA09D
                                                                                            • GetKeyState.USER32(000000A0), ref: 00DCA0B4
                                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00DCA0E3
                                                                                            • GetKeyState.USER32(000000A1), ref: 00DCA0F4
                                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00DCA120
                                                                                            • GetKeyState.USER32(00000011), ref: 00DCA12E
                                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00DCA157
                                                                                            • GetKeyState.USER32(00000012), ref: 00DCA165
                                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00DCA18E
                                                                                            • GetKeyState.USER32(0000005B), ref: 00DCA19C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: State$Async$Keyboard
                                                                                            • String ID:
                                                                                            • API String ID: 541375521-0
                                                                                            • Opcode ID: 6078cd28ff3eba4dee9d17f84c058b269de1d2a7f2fe55c5aa712c8c9e502522
                                                                                            • Instruction ID: 2782cf59a7c3cd30abfc494798bd9b442c83ef077d936f2415a20cb5092fc631
                                                                                            • Opcode Fuzzy Hash: 6078cd28ff3eba4dee9d17f84c058b269de1d2a7f2fe55c5aa712c8c9e502522
                                                                                            • Instruction Fuzzy Hash: 0751C82090478E29FB35DB748415FEAEFB59F12384F0C859DD5C2571C2DA64AA4CC772
                                                                                            Function 00DC5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00DC5CE2
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00DC5CFB
                                                                                            • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00DC5D59
                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00DC5D69
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00DC5D7B
                                                                                            • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00DC5DCF
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00DC5DDD
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00DC5DEF
                                                                                            • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00DC5E31
                                                                                            • GetDlgItem.USER32(?,000003EA), ref: 00DC5E44
                                                                                            • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00DC5E5A
                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00DC5E67
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ItemMoveRect$Invalidate
                                                                                            • String ID:
                                                                                            • API String ID: 3096461208-0
                                                                                            • Opcode ID: 209fdec8acdaa71433cfbb57840a5cb80f1913ea04b26a44f1dcd3887469c3cc
                                                                                            • Instruction ID: 69cf33864abb1b736457a97f53707715ac980eaeed6dca4a70852b62a2257c58
                                                                                            • Opcode Fuzzy Hash: 209fdec8acdaa71433cfbb57840a5cb80f1913ea04b26a44f1dcd3887469c3cc
                                                                                            • Instruction Fuzzy Hash: C4510071A1070AAFDF14DF68DD89FAE7BB9AB48300F148129F516E7294D770AD50CB60
                                                                                            Function 00D78BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D78BE8,?,00000000,?,?,?,?,00D78BBA,00000000,?), ref: 00D78FC5
                                                                                            • DestroyWindow.USER32(?), ref: 00D78C81
                                                                                            • KillTimer.USER32(00000000,?,?,?,?,00D78BBA,00000000,?), ref: 00D78D1B
                                                                                            • DestroyAcceleratorTable.USER32(00000000), ref: 00DB6973
                                                                                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00D78BBA,00000000,?), ref: 00DB69A1
                                                                                            • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00D78BBA,00000000,?), ref: 00DB69B8
                                                                                            • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00D78BBA,00000000), ref: 00DB69D4
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DB69E6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                            • String ID:
                                                                                            • API String ID: 641708696-0
                                                                                            • Opcode ID: d0cf0f233482757c976ef53f180755785c41655893465abc45787b77597b063c
                                                                                            • Instruction ID: a33e724d2c838ba6406f7cefc96539d39c4ea93720689ff21bccdaf993c5d745
                                                                                            • Opcode Fuzzy Hash: d0cf0f233482757c976ef53f180755785c41655893465abc45787b77597b063c
                                                                                            • Instruction Fuzzy Hash: 79618A30501708DFCB269F15CA4CB65BBF1FB40312F18856CE086A66A0DB35E994EFB0
                                                                                            Function 00D79838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79944: GetWindowLongW.USER32(?,000000EB), ref: 00D79952
                                                                                            • GetSysColor.USER32(0000000F), ref: 00D79862
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ColorLongWindow
                                                                                            • String ID:
                                                                                            • API String ID: 259745315-0
                                                                                            • Opcode ID: 0bbacaf4522cd446eb55ad2388f11d62fd2c40cb4ab8e75cefbf22ddfc4ae5a4
                                                                                            • Instruction ID: 7eabe929ab5ea927fd3415c83ef7156da75ec3a387fc1d6620572e3a2d9beb7c
                                                                                            • Opcode Fuzzy Hash: 0bbacaf4522cd446eb55ad2388f11d62fd2c40cb4ab8e75cefbf22ddfc4ae5a4
                                                                                            • Instruction Fuzzy Hash: 6841B132104704AFDB209F389C94BB97BA5AB47330F188646F9A6872E1E7319D52DB31
                                                                                            Function 00DC96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00DAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00DC9717
                                                                                            • LoadStringW.USER32(00000000,?,00DAF7F8,00000001), ref: 00DC9720
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00DAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00DC9742
                                                                                            • LoadStringW.USER32(00000000,?,00DAF7F8,00000001), ref: 00DC9745
                                                                                            • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00DC9866
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleLoadModuleString$Message_wcslen
                                                                                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                            • API String ID: 747408836-2268648507
                                                                                            • Opcode ID: d49a3275ac14174308b722d1ff368657d6fcb1b9a874a9b57b71f9c3dd323cde
                                                                                            • Instruction ID: dba451495fef269ad4a662b862a4b6040198cc931eda07df56201a259f475f40
                                                                                            • Opcode Fuzzy Hash: d49a3275ac14174308b722d1ff368657d6fcb1b9a874a9b57b71f9c3dd323cde
                                                                                            • Instruction Fuzzy Hash: 24412A72800219ABCB04EBA0DE96EEEB778EF55340F604129B60573192EB356F48CA71
                                                                                            Function 00DC06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00DC07A2
                                                                                            • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00DC07BE
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00DC07DA
                                                                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00DC0804
                                                                                            • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00DC082C
                                                                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DC0837
                                                                                            • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DC083C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                            • API String ID: 323675364-22481851
                                                                                            • Opcode ID: 5d639438f1097bb8e58aa3f407779ea77442ccd3289edb202598e817d9dd8645
                                                                                            • Instruction ID: 50b7bd4c6e4eadb853245be51ba237fad722f431b857a9a3688014608b512653
                                                                                            • Opcode Fuzzy Hash: 5d639438f1097bb8e58aa3f407779ea77442ccd3289edb202598e817d9dd8645
                                                                                            • Instruction Fuzzy Hash: 2041E272810229ABDB15EBA4DC95DEDB778EF54750B148129E911B32A1EB30AE44CBB0
                                                                                            Function 00DF3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00DF403B
                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 00DF4042
                                                                                            • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00DF4055
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00DF405D
                                                                                            • GetPixel.GDI32(00000000,00000000,00000000), ref: 00DF4068
                                                                                            • DeleteDC.GDI32(00000000), ref: 00DF4072
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00DF407C
                                                                                            • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00DF4092
                                                                                            • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00DF409E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                            • String ID: static
                                                                                            • API String ID: 2559357485-2160076837
                                                                                            • Opcode ID: c15cc476348866de218d9d44a91675c88856084555c874f7cf4293c0fbff23b8
                                                                                            • Instruction ID: 0faf7b19ed2ef9d2bb87e9be555f1141203bf58747d2545043bbaca023f47f62
                                                                                            • Opcode Fuzzy Hash: c15cc476348866de218d9d44a91675c88856084555c874f7cf4293c0fbff23b8
                                                                                            • Instruction Fuzzy Hash: 3631493251121DABDF219FA4CD09FEA3B68EF09324F169211FB15E62A0CB75D860DB74
                                                                                            Function 00DE3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DE3C5C
                                                                                            • CoInitialize.OLE32(00000000), ref: 00DE3C8A
                                                                                            • CoUninitialize.OLE32 ref: 00DE3C94
                                                                                            • _wcslen.LIBCMT ref: 00DE3D2D
                                                                                            • GetRunningObjectTable.OLE32(00000000,?), ref: 00DE3DB1
                                                                                            • SetErrorMode.KERNEL32(00000001,00000029), ref: 00DE3ED5
                                                                                            • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00DE3F0E
                                                                                            • CoGetObject.OLE32(?,00000000,00DFFB98,?), ref: 00DE3F2D
                                                                                            • SetErrorMode.KERNEL32(00000000), ref: 00DE3F40
                                                                                            • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DE3FC4
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DE3FD8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 429561992-0
                                                                                            • Opcode ID: ddc9ce9c17f1e34329f0d53ac01dcc0d6224fd698a6ca0b40dc436a082f06603
                                                                                            • Instruction ID: 0ca0e216d7cff785e4027ee397bb398480a99dcefb7bd8561f64600fce21e902
                                                                                            • Opcode Fuzzy Hash: ddc9ce9c17f1e34329f0d53ac01dcc0d6224fd698a6ca0b40dc436a082f06603
                                                                                            • Instruction Fuzzy Hash: 08C123716083459FC700EF69C88892BBBE9FF89748F14495DF98A9B210D731EE05CB62
                                                                                            Function 00DD7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CoInitialize.OLE32(00000000), ref: 00DD7AF3
                                                                                            • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00DD7B8F
                                                                                            • SHGetDesktopFolder.SHELL32(?), ref: 00DD7BA3
                                                                                            • CoCreateInstance.OLE32(00DFFD08,00000000,00000001,00E26E6C,?), ref: 00DD7BEF
                                                                                            • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00DD7C74
                                                                                            • CoTaskMemFree.OLE32(?,?), ref: 00DD7CCC
                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00DD7D57
                                                                                            • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DD7D7A
                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00DD7D81
                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00DD7DD6
                                                                                            • CoUninitialize.OLE32 ref: 00DD7DDC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                                            • String ID:
                                                                                            • API String ID: 2762341140-0
                                                                                            • Opcode ID: 1de2c19fdaf4c93f6d9977a9e171cc8a4702e893061869277cf0e8d709121c59
                                                                                            • Instruction ID: c65ba4ac5cb23552136d68eaf9ba115bab4f7a57b2a82aa166ae35c32002cfac
                                                                                            • Opcode Fuzzy Hash: 1de2c19fdaf4c93f6d9977a9e171cc8a4702e893061869277cf0e8d709121c59
                                                                                            • Instruction Fuzzy Hash: BFC1EA75A04209AFCB14DFA4C894DAEBBF9FF48314B158499E81ADB361D730ED45CBA0
                                                                                            Function 00DF541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00DF5504
                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DF5515
                                                                                            • CharNextW.USER32(00000158), ref: 00DF5544
                                                                                            • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00DF5585
                                                                                            • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00DF559B
                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DF55AC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CharNext
                                                                                            • String ID:
                                                                                            • API String ID: 1350042424-0
                                                                                            • Opcode ID: c83792e324c75cfbf9ab911ac923115c85d7bad49b1e997d5de6754038ee2917
                                                                                            • Instruction ID: df14ef4da18dc393431fbd3538e5981dccf7f618cb80bab4f402e6016a1522ef
                                                                                            • Opcode Fuzzy Hash: c83792e324c75cfbf9ab911ac923115c85d7bad49b1e997d5de6754038ee2917
                                                                                            • Instruction Fuzzy Hash: C4618C3090460CEBDF109F54EC84AFE7BB9EB0A725F15C149FB65A62A4D7708A81DB70
                                                                                            Function 00DBFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00DBFAAF
                                                                                            • SafeArrayAllocData.OLEAUT32(?), ref: 00DBFB08
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DBFB1A
                                                                                            • SafeArrayAccessData.OLEAUT32(?,?), ref: 00DBFB3A
                                                                                            • VariantCopy.OLEAUT32(?,?), ref: 00DBFB8D
                                                                                            • SafeArrayUnaccessData.OLEAUT32(?), ref: 00DBFBA1
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DBFBB6
                                                                                            • SafeArrayDestroyData.OLEAUT32(?), ref: 00DBFBC3
                                                                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DBFBCC
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DBFBDE
                                                                                            • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DBFBE9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                            • String ID:
                                                                                            • API String ID: 2706829360-0
                                                                                            • Opcode ID: 43c75d5b7311d3836585fcfbbe48952bd799c9162df42bc4b02ce831c4c78b99
                                                                                            • Instruction ID: 62fccb9318b848a52b8ed7ae43432e1408866296e312998450f3c87fd3a139a0
                                                                                            • Opcode Fuzzy Hash: 43c75d5b7311d3836585fcfbbe48952bd799c9162df42bc4b02ce831c4c78b99
                                                                                            • Instruction Fuzzy Hash: 57412B35A10219EFCB14DFA8DC549EEBBB9EF48344F00C469E956E7261DB30A945CBB0
                                                                                            Function 00DC9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?), ref: 00DC9CA1
                                                                                            • GetAsyncKeyState.USER32(000000A0), ref: 00DC9D22
                                                                                            • GetKeyState.USER32(000000A0), ref: 00DC9D3D
                                                                                            • GetAsyncKeyState.USER32(000000A1), ref: 00DC9D57
                                                                                            • GetKeyState.USER32(000000A1), ref: 00DC9D6C
                                                                                            • GetAsyncKeyState.USER32(00000011), ref: 00DC9D84
                                                                                            • GetKeyState.USER32(00000011), ref: 00DC9D96
                                                                                            • GetAsyncKeyState.USER32(00000012), ref: 00DC9DAE
                                                                                            • GetKeyState.USER32(00000012), ref: 00DC9DC0
                                                                                            • GetAsyncKeyState.USER32(0000005B), ref: 00DC9DD8
                                                                                            • GetKeyState.USER32(0000005B), ref: 00DC9DEA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: State$Async$Keyboard
                                                                                            • String ID:
                                                                                            • API String ID: 541375521-0
                                                                                            • Opcode ID: 32930e8c2ade20b171612a5ddc303c4741dd82f340685d754f527cc3571cec93
                                                                                            • Instruction ID: 25920d2d550a6b8f64aff226fb9a738d9c2f7073057a736989f1484e62062319
                                                                                            • Opcode Fuzzy Hash: 32930e8c2ade20b171612a5ddc303c4741dd82f340685d754f527cc3571cec93
                                                                                            • Instruction Fuzzy Hash: 3A41D8745047CB69FF308660952CBB5FEA06B21344F0C805ED6C7676C2DBA499D8C7B2
                                                                                            Function 00DE055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WSAStartup.WSOCK32(00000101,?), ref: 00DE05BC
                                                                                            • inet_addr.WSOCK32(?), ref: 00DE061C
                                                                                            • gethostbyname.WSOCK32(?), ref: 00DE0628
                                                                                            • IcmpCreateFile.IPHLPAPI ref: 00DE0636
                                                                                            • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00DE06C6
                                                                                            • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00DE06E5
                                                                                            • IcmpCloseHandle.IPHLPAPI(?), ref: 00DE07B9
                                                                                            • WSACleanup.WSOCK32 ref: 00DE07BF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                            • String ID: Ping
                                                                                            • API String ID: 1028309954-2246546115
                                                                                            • Opcode ID: 07aa72b2255047fbe15176027573ecbeec8e881676bf26c6caaf0e27688c7789
                                                                                            • Instruction ID: db32e3560ebba31ffc5e54ef1bca413b2e8f7be257a8062ca471c5f5a4a6299b
                                                                                            • Opcode Fuzzy Hash: 07aa72b2255047fbe15176027573ecbeec8e881676bf26c6caaf0e27688c7789
                                                                                            • Instruction Fuzzy Hash: 36917E356042819FD720EF16C589F1ABBE0EF44318F188599E4A98B7A2D770ED85CFA1
                                                                                            Function 00DE8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$BuffCharLower
                                                                                            • String ID: cdecl$none$stdcall$winapi
                                                                                            • API String ID: 707087890-567219261
                                                                                            • Opcode ID: be2115735cbcc622e312ef89ccb842282bebcb5bf92af923c4ec14df7881fd3c
                                                                                            • Instruction ID: 5a8fe636d55e13ab1fb56a5ccd81340c1f475d9214b82dea3a36f8c12361ab2e
                                                                                            • Opcode Fuzzy Hash: be2115735cbcc622e312ef89ccb842282bebcb5bf92af923c4ec14df7881fd3c
                                                                                            • Instruction Fuzzy Hash: D751C131A005569BCB24EF6DC9419BEB3A5FF64724B244229F46AE72C4DB31DD40E7B0
                                                                                            Function 00DE372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CoInitialize.OLE32 ref: 00DE3774
                                                                                            • CoUninitialize.OLE32 ref: 00DE377F
                                                                                            • CoCreateInstance.OLE32(?,00000000,00000017,00DFFB78,?), ref: 00DE37D9
                                                                                            • IIDFromString.OLE32(?,?), ref: 00DE384C
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DE38E4
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DE3936
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                            • API String ID: 636576611-1287834457
                                                                                            • Opcode ID: c3747a3910145f2d3734c54e70141452c616fe6156ecde2f8b89b529c0d485c0
                                                                                            • Instruction ID: 651da0208f7d4f79ee51601933708e7449a0dedc5d7fb4157af9da04e18fc4b0
                                                                                            • Opcode Fuzzy Hash: c3747a3910145f2d3734c54e70141452c616fe6156ecde2f8b89b529c0d485c0
                                                                                            • Instruction Fuzzy Hash: B461AC71608341AFD310EF56D888B6ABBE8EF48714F04480DF9859B291D770EE48CBB2
                                                                                            Function 00DD3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00DD33CF
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00DD33F0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LoadString$_wcslen
                                                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                                            • API String ID: 4099089115-3080491070
                                                                                            • Opcode ID: 834a9c0a877386aaf0f760665a5cf14d33d63fb2fbc44ccfb1ea9d4cc2e0eb74
                                                                                            • Instruction ID: 64a7daded59c2d986e268fa531e16c21d1fd714cc976cb7935e55186e4a119a0
                                                                                            • Opcode Fuzzy Hash: 834a9c0a877386aaf0f760665a5cf14d33d63fb2fbc44ccfb1ea9d4cc2e0eb74
                                                                                            • Instruction Fuzzy Hash: 79518A7290020AABDF14EBA0DE56EEEB778EF14340F244166F505721A2EB316F58DB71
                                                                                            Function 00DCB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$BuffCharUpper
                                                                                            • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                                            • API String ID: 1256254125-769500911
                                                                                            • Opcode ID: 3f44512fa59a468ff7d36b0b7de46a0a6a88c87fe4dbbb5438efe037a2af10d2
                                                                                            • Instruction ID: 6770b7cb38451f63026b68bf0eacd791a296a3413b2e206b70468030b2893033
                                                                                            • Opcode Fuzzy Hash: 3f44512fa59a468ff7d36b0b7de46a0a6a88c87fe4dbbb5438efe037a2af10d2
                                                                                            • Instruction Fuzzy Hash: 98419932A401279BCB206E7DC992BBE77A5AB60774F29422FE465DB284E731CD41C770
                                                                                            Function 00DD5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00DD53A0
                                                                                            • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00DD5416
                                                                                            • GetLastError.KERNEL32 ref: 00DD5420
                                                                                            • SetErrorMode.KERNEL32(00000000,READY), ref: 00DD54A7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Error$Mode$DiskFreeLastSpace
                                                                                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                            • API String ID: 4194297153-14809454
                                                                                            • Opcode ID: 77977dedb239c0594b836344c7e5c790ca5f943fdd1c7818ef56656221d6d252
                                                                                            • Instruction ID: 6d0b02f4055e628327a5ca82151cfc12fa943712e73b9d9532a138807c2f85c4
                                                                                            • Opcode Fuzzy Hash: 77977dedb239c0594b836344c7e5c790ca5f943fdd1c7818ef56656221d6d252
                                                                                            • Instruction Fuzzy Hash: F631A535A006089FC710DF68E585EAABBB4EF45305F18806AE406DB396D771DD86CBB2
                                                                                            Function 00DF3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateMenu.USER32 ref: 00DF3C79
                                                                                            • SetMenu.USER32(?,00000000), ref: 00DF3C88
                                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DF3D10
                                                                                            • IsMenu.USER32(?), ref: 00DF3D24
                                                                                            • CreatePopupMenu.USER32 ref: 00DF3D2E
                                                                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DF3D5B
                                                                                            • DrawMenuBar.USER32 ref: 00DF3D63
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                                            • String ID: 0$F
                                                                                            • API String ID: 161812096-3044882817
                                                                                            • Opcode ID: 14340c50b1f162b50e72bde0a2545232c33a7f596691a09ecfb3e3fe3bc72f69
                                                                                            • Instruction ID: fff3946d6e2fc53a1bcb64375db11d29b87a50b5ea749cde90769cb7ec4d4362
                                                                                            • Opcode Fuzzy Hash: 14340c50b1f162b50e72bde0a2545232c33a7f596691a09ecfb3e3fe3bc72f69
                                                                                            • Instruction Fuzzy Hash: AD416C75A0130DEFDB14DF64E844AAA7BB5FF49350F168028EA46A7360D730AA15CF60
                                                                                            Function 00DC1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00DC1F64
                                                                                            • GetDlgCtrlID.USER32 ref: 00DC1F6F
                                                                                            • GetParent.USER32 ref: 00DC1F8B
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DC1F8E
                                                                                            • GetDlgCtrlID.USER32(?), ref: 00DC1F97
                                                                                            • GetParent.USER32(?), ref: 00DC1FAB
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DC1FAE
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 711023334-1403004172
                                                                                            • Opcode ID: b9e5ded7176f29fabc332a6a69b7de4fa6bb77716720c711b1ec586ebacbfa17
                                                                                            • Instruction ID: 0f7737b9336ace76d387ecb19db8f86c82cab56d8eb740ad5309bc474f97f3eb
                                                                                            • Opcode Fuzzy Hash: b9e5ded7176f29fabc332a6a69b7de4fa6bb77716720c711b1ec586ebacbfa17
                                                                                            • Instruction Fuzzy Hash: 1F21C575900218BBCF04AFA0DD55EFEBBB8EF16310B105119F951A72A1CB749924DB70
                                                                                            Function 00DC1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00DC2043
                                                                                            • GetDlgCtrlID.USER32 ref: 00DC204E
                                                                                            • GetParent.USER32 ref: 00DC206A
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DC206D
                                                                                            • GetDlgCtrlID.USER32(?), ref: 00DC2076
                                                                                            • GetParent.USER32(?), ref: 00DC208A
                                                                                            • SendMessageW.USER32(00000000,?,00000111,?), ref: 00DC208D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 711023334-1403004172
                                                                                            • Opcode ID: fc3a4079cfa84114ed173a2bc9b7c11b3cfad736433558753817e11f9620372a
                                                                                            • Instruction ID: 91719fe82fc9e39b048fec01100853a92bb27a78a4789731279ac469d156bae3
                                                                                            • Opcode Fuzzy Hash: fc3a4079cfa84114ed173a2bc9b7c11b3cfad736433558753817e11f9620372a
                                                                                            • Instruction Fuzzy Hash: F521C6B5900218BBCF10AFA0DD45EFEBBB8EF15340F10541AF951E72A1DA758925DB70
                                                                                            Function 00DF3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00DF3A9D
                                                                                            • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00DF3AA0
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF3AC7
                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DF3AEA
                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00DF3B62
                                                                                            • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00DF3BAC
                                                                                            • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00DF3BC7
                                                                                            • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00DF3BE2
                                                                                            • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00DF3BF6
                                                                                            • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00DF3C13
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$LongWindow
                                                                                            • String ID:
                                                                                            • API String ID: 312131281-0
                                                                                            • Opcode ID: b77cdeebc84cdb537b76af5b13fb08b49e14215a3f6ce2a630f53ab870addd58
                                                                                            • Instruction ID: 6ccb8c60ccb40823321a4a017ee780db429c4bb378af47a94c1eae491d483422
                                                                                            • Opcode Fuzzy Hash: b77cdeebc84cdb537b76af5b13fb08b49e14215a3f6ce2a630f53ab870addd58
                                                                                            • Instruction Fuzzy Hash: CD616875A00248AFDB10DFA8CC85EFE77B8EB49700F158199FA15E72A1C770AE45DB60
                                                                                            Function 00D92C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00D92C94
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • _free.LIBCMT ref: 00D92CA0
                                                                                            • _free.LIBCMT ref: 00D92CAB
                                                                                            • _free.LIBCMT ref: 00D92CB6
                                                                                            • _free.LIBCMT ref: 00D92CC1
                                                                                            • _free.LIBCMT ref: 00D92CCC
                                                                                            • _free.LIBCMT ref: 00D92CD7
                                                                                            • _free.LIBCMT ref: 00D92CE2
                                                                                            • _free.LIBCMT ref: 00D92CED
                                                                                            • _free.LIBCMT ref: 00D92CFB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 624406e7b5ca8c20a8a2b55fcd84adc195d6a64a7d7d4b0f92a079c5fb27e7c4
                                                                                            • Instruction ID: 55165ccbf5287b6433abb1cc6a4a71c0502c33a80a65b136c743e3f0888b3a03
                                                                                            • Opcode Fuzzy Hash: 624406e7b5ca8c20a8a2b55fcd84adc195d6a64a7d7d4b0f92a079c5fb27e7c4
                                                                                            • Instruction Fuzzy Hash: A4112D76550108BFCF02EF94D982CAD3BA9FF05350F9545A5FA489B222DB31EA509FB0
                                                                                            Function 00DD7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DD7FAD
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD7FC1
                                                                                            • GetFileAttributesW.KERNEL32(?), ref: 00DD7FEB
                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00DD8005
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD8017
                                                                                            • SetCurrentDirectoryW.KERNEL32(?), ref: 00DD8060
                                                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DD80B0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentDirectory$AttributesFile
                                                                                            • String ID: *.*
                                                                                            • API String ID: 769691225-438819550
                                                                                            • Opcode ID: 269a73285f3a409e2f1e399bea9c1c5680b9ad953d67db67b1222694ccfbedea
                                                                                            • Instruction ID: 462a3476e7bbfaae918d2e179c5246efd2746ac8ae27feab0af636c14e726e03
                                                                                            • Opcode Fuzzy Hash: 269a73285f3a409e2f1e399bea9c1c5680b9ad953d67db67b1222694ccfbedea
                                                                                            • Instruction Fuzzy Hash: 9A818E725082469BCB20EF54C844ABAB3E8EF88314F18489FF885D7350EB34DD499B72
                                                                                            Function 00D65BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetWindowLongW.USER32(?,000000EB), ref: 00D65C7A
                                                                                              • Part of subcall function 00D65D0A: GetClientRect.USER32(?,?), ref: 00D65D30
                                                                                              • Part of subcall function 00D65D0A: GetWindowRect.USER32(?,?), ref: 00D65D71
                                                                                              • Part of subcall function 00D65D0A: ScreenToClient.USER32(?,?), ref: 00D65D99
                                                                                            • GetDC.USER32 ref: 00DA46F5
                                                                                            • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DA4708
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00DA4716
                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00DA472B
                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00DA4733
                                                                                            • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DA47C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                            • String ID: U
                                                                                            • API String ID: 4009187628-3372436214
                                                                                            • Opcode ID: bf4d5d99d5e21087e3911260a26d0af0742cbd650ab0bfc2f961ee5f8d01a14c
                                                                                            • Instruction ID: 159987cbbd6a215d5d7bfcfdd76ea36dfde149566beaa25749d4f9a7372445af
                                                                                            • Opcode Fuzzy Hash: bf4d5d99d5e21087e3911260a26d0af0742cbd650ab0bfc2f961ee5f8d01a14c
                                                                                            • Instruction Fuzzy Hash: 4271C231400249DFCF218F64D984AFA7BB5FF86360F1C4269E9555A26AC7B1C891DFB0
                                                                                            Function 00DD359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DD35E4
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • LoadStringW.USER32(00E32390,?,00000FFF,?), ref: 00DD360A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LoadString$_wcslen
                                                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                            • API String ID: 4099089115-2391861430
                                                                                            • Opcode ID: cf7286540f8d38f6e510f5fd7ca2222bd1ab70f965ccc89e418f897172003f19
                                                                                            • Instruction ID: 8b47e3d75a3d37ddf9ea05d32f5fc85d18f20694fd1fdcf88d12a8a16fa07d3b
                                                                                            • Opcode Fuzzy Hash: cf7286540f8d38f6e510f5fd7ca2222bd1ab70f965ccc89e418f897172003f19
                                                                                            • Instruction Fuzzy Hash: 5D515F72800219BBDF14EBA0DD56EEDBB78EF14300F145165F105721A1EB315A99DF71
                                                                                            Function 00DDC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DDC272
                                                                                            • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DDC29A
                                                                                            • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DDC2CA
                                                                                            • GetLastError.KERNEL32 ref: 00DDC322
                                                                                            • SetEvent.KERNEL32(?), ref: 00DDC336
                                                                                            • InternetCloseHandle.WININET(00000000), ref: 00DDC341
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                                            • String ID:
                                                                                            • API String ID: 3113390036-3916222277
                                                                                            • Opcode ID: 15caa7ba0f470a5eec99f9d11fdd248997dd81ace2d436af329e526d1d44f712
                                                                                            • Instruction ID: 298cd9b06b6143815408f3fe6de40b19b6723a2672023e3f425cd2eccdb5da3b
                                                                                            • Opcode Fuzzy Hash: 15caa7ba0f470a5eec99f9d11fdd248997dd81ace2d436af329e526d1d44f712
                                                                                            • Instruction Fuzzy Hash: 6C315AB1620309AFDB21AF658988ABB7AFCEB49744F14951AF486D2310DB30ED04DB70
                                                                                            Function 00DC989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00DA3AAF,?,?,Bad directive syntax error,00DFCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00DC98BC
                                                                                            • LoadStringW.USER32(00000000,?,00DA3AAF,?), ref: 00DC98C3
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00DC9987
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleLoadMessageModuleString_wcslen
                                                                                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                            • API String ID: 858772685-4153970271
                                                                                            • Opcode ID: 5f32b81942301c8116885e34a0c1d5e88ee632a8000feed5e811f7be6f56d0b9
                                                                                            • Instruction ID: de42a2ce04d36a6171f00891d34757a77913243f96c61f3d60de8836d1ca64cf
                                                                                            • Opcode Fuzzy Hash: 5f32b81942301c8116885e34a0c1d5e88ee632a8000feed5e811f7be6f56d0b9
                                                                                            • Instruction Fuzzy Hash: 3A214D3280021EABCF15AF90CC1AEEEB779FF18700F045469F515661A2EB719628DB71
                                                                                            Function 00DC209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32 ref: 00DC20AB
                                                                                            • GetClassNameW.USER32(00000000,?,00000100), ref: 00DC20C0
                                                                                            • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00DC214D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassMessageNameParentSend
                                                                                            • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                            • API String ID: 1290815626-3381328864
                                                                                            • Opcode ID: faa11994eab5dd0bd06599f24e9bda4ca8cade61a082942b39f6cb7effcdcd5b
                                                                                            • Instruction ID: 55f71347ae4d9583223b98abc1063b5b085254850ef6408a4095bf4d567e3202
                                                                                            • Opcode Fuzzy Hash: faa11994eab5dd0bd06599f24e9bda4ca8cade61a082942b39f6cb7effcdcd5b
                                                                                            • Instruction Fuzzy Hash: 801106776C8717B9FA153620EC07EB6379CDF04728B24502AFB04FA0E1EE71A8115A34
                                                                                            Function 00D98D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3cd456a7b9136683d797e4afa8fe8a421064628b25f06de2a6a300a5fb02b5ef
                                                                                            • Instruction ID: 2f153a27619bd9a86bcdfe5bf05382aba105690c555a22ef20f17ebb4aab1e51
                                                                                            • Opcode Fuzzy Hash: 3cd456a7b9136683d797e4afa8fe8a421064628b25f06de2a6a300a5fb02b5ef
                                                                                            • Instruction Fuzzy Hash: 50C1DD74A04349AFDF11EFADC855BADBBB0AF4A310F084199F869A7392C7319941CB71
                                                                                            Function 00D9CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                                            • String ID:
                                                                                            • API String ID: 1282221369-0
                                                                                            • Opcode ID: 48439915d973f27c4ad11a08f6397cf8187da77137ef26f6b55e6f7435689532
                                                                                            • Instruction ID: 12fcfcb381fed1ad6f043c517526b7bfe96a5a0434d5637731235e9f4929ab32
                                                                                            • Opcode Fuzzy Hash: 48439915d973f27c4ad11a08f6397cf8187da77137ef26f6b55e6f7435689532
                                                                                            • Instruction Fuzzy Hash: 71612371A16304BFDF21EFB49895A7A7BE6EF05360F08416DF949A7282E7319D0187B0
                                                                                            Function 00DF50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00DF5186
                                                                                            • ShowWindow.USER32(?,00000000), ref: 00DF51C7
                                                                                            • ShowWindow.USER32(?,00000005,?,00000000), ref: 00DF51CD
                                                                                            • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00DF51D1
                                                                                              • Part of subcall function 00DF6FBA: DeleteObject.GDI32(00000000), ref: 00DF6FE6
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF520D
                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DF521A
                                                                                            • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00DF524D
                                                                                            • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00DF5287
                                                                                            • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00DF5296
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                                            • String ID:
                                                                                            • API String ID: 3210457359-0
                                                                                            • Opcode ID: 30fb7edba381e961fadf8caf96a4f3989189abcb34e5cbc8038f015714a53767
                                                                                            • Instruction ID: d56151da2ea7139de75ab14b79db872020475719fd643e945e101f7cfbc9a5d8
                                                                                            • Opcode Fuzzy Hash: 30fb7edba381e961fadf8caf96a4f3989189abcb34e5cbc8038f015714a53767
                                                                                            • Instruction Fuzzy Hash: 3F518030A50A0DBEEF209F24EC49BB87B65EF05325F19C211F7199A2E4C375A990DB74
                                                                                            Function 00D78B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00DB6890
                                                                                            • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00DB68A9
                                                                                            • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DB68B9
                                                                                            • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00DB68D1
                                                                                            • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DB68F2
                                                                                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D78874,00000000,00000000,00000000,000000FF,00000000), ref: 00DB6901
                                                                                            • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DB691E
                                                                                            • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D78874,00000000,00000000,00000000,000000FF,00000000), ref: 00DB692D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 1268354404-0
                                                                                            • Opcode ID: defab03e701e0f5dc5a11cb6793a7eec16cbfdfe16460fc4f635d5c3bac7e5dd
                                                                                            • Instruction ID: 978ad52841d158124cc775476987467ac274f1d5bd75a5e87599f64c48aad084
                                                                                            • Opcode Fuzzy Hash: defab03e701e0f5dc5a11cb6793a7eec16cbfdfe16460fc4f635d5c3bac7e5dd
                                                                                            • Instruction Fuzzy Hash: DF516970600309EFDB20CF25CC59FAA7BB5EB48750F148528F95AD72A0EB74E950EB60
                                                                                            Function 00DDC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DDC182
                                                                                            • GetLastError.KERNEL32 ref: 00DDC195
                                                                                            • SetEvent.KERNEL32(?), ref: 00DDC1A9
                                                                                              • Part of subcall function 00DDC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DDC272
                                                                                              • Part of subcall function 00DDC253: GetLastError.KERNEL32 ref: 00DDC322
                                                                                              • Part of subcall function 00DDC253: SetEvent.KERNEL32(?), ref: 00DDC336
                                                                                              • Part of subcall function 00DDC253: InternetCloseHandle.WININET(00000000), ref: 00DDC341
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                                            • String ID:
                                                                                            • API String ID: 337547030-0
                                                                                            • Opcode ID: b289b3c67875bd86670c639cee188b3e655ca0746161ddd7819bb2a249849718
                                                                                            • Instruction ID: dbe499d18e0598a1476aba40c1c57b5ebd21c97f3f2b21eaa4021c55a8bbcea5
                                                                                            • Opcode Fuzzy Hash: b289b3c67875bd86670c639cee188b3e655ca0746161ddd7819bb2a249849718
                                                                                            • Instruction Fuzzy Hash: 1D315871220706AFDB219FA59D44A76BBE9FF18300F14A41EF95AC6720D731E824DBB4
                                                                                            Function 00DC25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DC3A57
                                                                                              • Part of subcall function 00DC3A3D: GetCurrentThreadId.KERNEL32 ref: 00DC3A5E
                                                                                              • Part of subcall function 00DC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DC25B3), ref: 00DC3A65
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00DC25BD
                                                                                            • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00DC25DB
                                                                                            • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00DC25DF
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00DC25E9
                                                                                            • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00DC2601
                                                                                            • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00DC2605
                                                                                            • MapVirtualKeyW.USER32(00000025,00000000), ref: 00DC260F
                                                                                            • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00DC2623
                                                                                            • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00DC2627
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2014098862-0
                                                                                            • Opcode ID: db3113a297e3a4a6240102e00e01277139288d9602fa3bc8be713fe727e2b425
                                                                                            • Instruction ID: 35339398163cfbf75857de23f7889f784923a65c117bee9715d3858488fd37a3
                                                                                            • Opcode Fuzzy Hash: db3113a297e3a4a6240102e00e01277139288d9602fa3bc8be713fe727e2b425
                                                                                            • Instruction Fuzzy Hash: B701B1303A4314BBFB1067689C8AF693E59DF5AB12F105005F358EF1E1C9E26464CA79
                                                                                            Function 00DC1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00DC1449,?,?,00000000), ref: 00DC180C
                                                                                            • HeapAlloc.KERNEL32(00000000,?,00DC1449,?,?,00000000), ref: 00DC1813
                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DC1449,?,?,00000000), ref: 00DC1828
                                                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,00DC1449,?,?,00000000), ref: 00DC1830
                                                                                            • DuplicateHandle.KERNEL32(00000000,?,00DC1449,?,?,00000000), ref: 00DC1833
                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DC1449,?,?,00000000), ref: 00DC1843
                                                                                            • GetCurrentProcess.KERNEL32(00DC1449,00000000,?,00DC1449,?,?,00000000), ref: 00DC184B
                                                                                            • DuplicateHandle.KERNEL32(00000000,?,00DC1449,?,?,00000000), ref: 00DC184E
                                                                                            • CreateThread.KERNEL32(00000000,00000000,00DC1874,00000000,00000000,00000000), ref: 00DC1868
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                            • String ID:
                                                                                            • API String ID: 1957940570-0
                                                                                            • Opcode ID: 5a88023305acc400efaced2bb316e5a4e68aec9b15eb7eb54f80e44003a1b9f3
                                                                                            • Instruction ID: db044664d33bf6df44df7ed1137416d1b34a5c06630ee0d29be1e59aaebb0c53
                                                                                            • Opcode Fuzzy Hash: 5a88023305acc400efaced2bb316e5a4e68aec9b15eb7eb54f80e44003a1b9f3
                                                                                            • Instruction Fuzzy Hash: BB01BF75250308BFE710AB65DD4DF673BACEB89B11F009411FA05DB291C6709824DB70
                                                                                            Function 00DEA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DCD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00DCD501
                                                                                              • Part of subcall function 00DCD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00DCD50F
                                                                                              • Part of subcall function 00DCD4DC: FindCloseChangeNotification.KERNEL32(00000000), ref: 00DCD5DC
                                                                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DEA16D
                                                                                            • GetLastError.KERNEL32 ref: 00DEA180
                                                                                            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DEA1B3
                                                                                            • TerminateProcess.KERNEL32(00000000,00000000), ref: 00DEA268
                                                                                            • GetLastError.KERNEL32(00000000), ref: 00DEA273
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEA2C4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
                                                                                            • String ID: SeDebugPrivilege
                                                                                            • API String ID: 1701285019-2896544425
                                                                                            • Opcode ID: 6d242514f7f1d852a20f9a9bd01e6065bd183d6fd077f954dd41ca497b04158d
                                                                                            • Instruction ID: 8395336ed380da2f62d42ca25a8b089bc10d2228833e316a49f9ed3cd608e05a
                                                                                            • Opcode Fuzzy Hash: 6d242514f7f1d852a20f9a9bd01e6065bd183d6fd077f954dd41ca497b04158d
                                                                                            • Instruction Fuzzy Hash: E0617C302082829FD710EF19C494F25BBE1AF44318F19849CE5669B7A3C776FC45CBA6
                                                                                            Function 00DF3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00DF3925
                                                                                            • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00DF393A
                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00DF3954
                                                                                            • _wcslen.LIBCMT ref: 00DF3999
                                                                                            • SendMessageW.USER32(?,00001057,00000000,?), ref: 00DF39C6
                                                                                            • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00DF39F4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$Window_wcslen
                                                                                            • String ID: SysListView32
                                                                                            • API String ID: 2147712094-78025650
                                                                                            • Opcode ID: fbed67b02245e2431ddfde45fd883d84d619a6ee4080cf24d5607aa2b7ccfce0
                                                                                            • Instruction ID: 380d506fe568de2ce5031bf84cafadd46c75af6ea3b88557f69c27aceddd50af
                                                                                            • Opcode Fuzzy Hash: fbed67b02245e2431ddfde45fd883d84d619a6ee4080cf24d5607aa2b7ccfce0
                                                                                            • Instruction Fuzzy Hash: 1141D631A0031CABDF219F64CC45BFA77A9EF08350F164126FA48E7291D3B0D990CBA0
                                                                                            Function 00DCBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DCBCFD
                                                                                            • IsMenu.USER32(00000000), ref: 00DCBD1D
                                                                                            • CreatePopupMenu.USER32 ref: 00DCBD53
                                                                                            • GetMenuItemCount.USER32(00F85670), ref: 00DCBDA4
                                                                                            • InsertMenuItemW.USER32(00F85670,?,00000001,00000030), ref: 00DCBDCC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                                            • String ID: 0$2
                                                                                            • API String ID: 93392585-3793063076
                                                                                            • Opcode ID: bff77172ca65090e45ddb2aa0179e11c2862dd9e0814f197bc033f5ab97e2e10
                                                                                            • Instruction ID: c5f4f252e1c8ab30902941181a941d8a0314281634177eb474f85f784191f07b
                                                                                            • Opcode Fuzzy Hash: bff77172ca65090e45ddb2aa0179e11c2862dd9e0814f197bc033f5ab97e2e10
                                                                                            • Instruction Fuzzy Hash: 4F517B7060020A9BDF10DFA8D986FAEBBE8AF45324F18825EE44397290E770D945CB71
                                                                                            Function 00DCC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadIconW.USER32(00000000,00007F03), ref: 00DCC913
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: IconLoad
                                                                                            • String ID: blank$info$question$stop$warning
                                                                                            • API String ID: 2457776203-404129466
                                                                                            • Opcode ID: fb3f3cfb02e2c54cf6baf45a003f9d190bb9ad2e4f6d9599c64178619d8a4a17
                                                                                            • Instruction ID: ab729dbb24b9ff2edd86eda84076abee0b1ffa739769cf2c6ee2989d55bb98b2
                                                                                            • Opcode Fuzzy Hash: fb3f3cfb02e2c54cf6baf45a003f9d190bb9ad2e4f6d9599c64178619d8a4a17
                                                                                            • Instruction Fuzzy Hash: BE112B31699317BAE704AB14AC82EAB27ACDF15359B24202FF608A7282DB709D005774
                                                                                            Function 00DCDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                            • String ID: 0.0.0.0
                                                                                            • API String ID: 642191829-3771769585
                                                                                            • Opcode ID: a026b6033f152fc66724f9f607d970fb2a8a9b76a4c58a7880a7045ab1edb99b
                                                                                            • Instruction ID: b57f8cae125122f1b411a36d6e1ad60d673f3c645dc1b8b3be5151945f7fa9d1
                                                                                            • Opcode Fuzzy Hash: a026b6033f152fc66724f9f607d970fb2a8a9b76a4c58a7880a7045ab1edb99b
                                                                                            • Instruction Fuzzy Hash: 9811D27190421AAFCB24BB209C0AEEA77ADDB15710F05017EF589E7191EF708A85CBB0
                                                                                            Function 00DF9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00DF9FC7
                                                                                            • GetSystemMetrics.USER32(0000000F), ref: 00DF9FE7
                                                                                            • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00DFA224
                                                                                            • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00DFA242
                                                                                            • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00DFA263
                                                                                            • ShowWindow.USER32(00000003,00000000), ref: 00DFA282
                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 00DFA2A7
                                                                                            • DefDlgProcW.USER32(?,00000005,?,?), ref: 00DFA2CA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                                            • String ID:
                                                                                            • API String ID: 1211466189-0
                                                                                            • Opcode ID: 5062ae5bcd6b60bc980acdcef609cedce2610ceeed4eb9e6c270c54deb1f5274
                                                                                            • Instruction ID: 10f25151010d1c6de2ec1209fcd0010f26af5b79e96cceed3472f3e42c2b8f5c
                                                                                            • Opcode Fuzzy Hash: 5062ae5bcd6b60bc980acdcef609cedce2610ceeed4eb9e6c270c54deb1f5274
                                                                                            • Instruction Fuzzy Hash: 12B16971600219AFDF14CF6CC9857BE7BB2BF44701F0AD06AEE49AB295D731A940CB61
                                                                                            Function 00DCED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$LocalTime
                                                                                            • String ID:
                                                                                            • API String ID: 952045576-0
                                                                                            • Opcode ID: 1170a4b9e2229205df91629395b7b5794dddb7950ce40ca31c8a0a3fa8f776a2
                                                                                            • Instruction ID: f55acb6de7d01afe3d08fe3756fa839e7a93bddf870274e03aeb7094b5ac676d
                                                                                            • Opcode Fuzzy Hash: 1170a4b9e2229205df91629395b7b5794dddb7950ce40ca31c8a0a3fa8f776a2
                                                                                            • Instruction Fuzzy Hash: AB41A165C1021976CB21FBB4888AACFB7ACEF45310F508566F518E3162FB34E255C7B9
                                                                                            Function 00D7F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DB682C,00000004,00000000,00000000), ref: 00D7F953
                                                                                            • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00DB682C,00000004,00000000,00000000), ref: 00DBF3D1
                                                                                            • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DB682C,00000004,00000000,00000000), ref: 00DBF454
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ShowWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1268545403-0
                                                                                            • Opcode ID: 19e303c87a26862534ab4ec6845c960ab77a6b3d95babf2291a7dc80d764bd04
                                                                                            • Instruction ID: 08879c655d72d11729f1ca72010ce9da610b47eef783d655b047f5e4c7fd46ee
                                                                                            • Opcode Fuzzy Hash: 19e303c87a26862534ab4ec6845c960ab77a6b3d95babf2291a7dc80d764bd04
                                                                                            • Instruction Fuzzy Hash: 0341B631518784FAC7399B298D8877E7A91AB55314F18D43CE29F96661E7319880CF31
                                                                                            Function 00DF2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteObject.GDI32(00000000), ref: 00DF2D1B
                                                                                            • GetDC.USER32(00000000), ref: 00DF2D23
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DF2D2E
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00DF2D3A
                                                                                            • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00DF2D76
                                                                                            • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00DF2D87
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00DF5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00DF2DC2
                                                                                            • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00DF2DE1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3864802216-0
                                                                                            • Opcode ID: ae696a6e2acb65ee249990ac706ed5e181679e2c023a10c2e0b4083db53a3f0e
                                                                                            • Instruction ID: 2f81449017b2b729d2cf15e263abeda47ec5516e31f7ffef7596cb1becb454d2
                                                                                            • Opcode Fuzzy Hash: ae696a6e2acb65ee249990ac706ed5e181679e2c023a10c2e0b4083db53a3f0e
                                                                                            • Instruction Fuzzy Hash: 0E316B72211618BBEB118F50CD8AFFB3BA9EF09715F088055FE08DA2A1D6759C51CBB4
                                                                                            Function 00DC5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memcmp
                                                                                            • String ID:
                                                                                            • API String ID: 2931989736-0
                                                                                            • Opcode ID: e396d92be4e0099b11ce6a8f75dde6ba856fc3504969ef2b6c1f77f96fcc0cf3
                                                                                            • Instruction ID: 105a01d8932454da81ac9465d977c0a88e4bb2dca106c5a9418e17844e8fc92e
                                                                                            • Opcode Fuzzy Hash: e396d92be4e0099b11ce6a8f75dde6ba856fc3504969ef2b6c1f77f96fcc0cf3
                                                                                            • Instruction Fuzzy Hash: 3521C965680A1A7BD614A720AD82FFB335CEF21384F484028FE059B585F721FD9982B9
                                                                                            Function 00DE4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: NULL Pointer assignment$Not an Object type
                                                                                            • API String ID: 0-572801152
                                                                                            • Opcode ID: 3fb721364a88490a922541310c80b84ea30e435890bc95b0b491b9d19c7df993
                                                                                            • Instruction ID: ea8915cdbd37c0c86ef8ed9393b3afad416dacca0d2890fe630de1efa9dd2555
                                                                                            • Opcode Fuzzy Hash: 3fb721364a88490a922541310c80b84ea30e435890bc95b0b491b9d19c7df993
                                                                                            • Instruction Fuzzy Hash: 1DD1A071A0074A9FDF10DF99D880BAEB7B5BF48388F188069E915AB285D770DD45CBB0
                                                                                            Function 00DA1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCPInfo.KERNEL32(?,?), ref: 00DA15CE
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DA1651
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DA16E4
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DA16FB
                                                                                              • Part of subcall function 00D93820: RtlAllocateHeap.NTDLL(00000000,?,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6,?,00D61129), ref: 00D93852
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DA1777
                                                                                            • __freea.LIBCMT ref: 00DA17A2
                                                                                            • __freea.LIBCMT ref: 00DA17AE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                                            • String ID:
                                                                                            • API String ID: 2829977744-0
                                                                                            • Opcode ID: edc1e968236dd8e03741376479dd0aaf1cc5d95451844b976a733371c0656cc3
                                                                                            • Instruction ID: bd27e89e7a38f330ed719eecf2bb232376724feeeac6972979aa364185c3dcef
                                                                                            • Opcode Fuzzy Hash: edc1e968236dd8e03741376479dd0aaf1cc5d95451844b976a733371c0656cc3
                                                                                            • Instruction Fuzzy Hash: 8891A179E042169ADF249F64C881AEE7BB5EF4A310F1C5659E802E7181E735DC44CB70
                                                                                            Function 00DE4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearInit
                                                                                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                            • API String ID: 2610073882-625585964
                                                                                            • Opcode ID: 774aa81475d06455c481684f8122007f0a5f63cd5d3d4b73b265e54d7cc9f1e9
                                                                                            • Instruction ID: fefd4ace91f69131ad92bceba285263697ad9f0db2226309b5e2a49413f56412
                                                                                            • Opcode Fuzzy Hash: 774aa81475d06455c481684f8122007f0a5f63cd5d3d4b73b265e54d7cc9f1e9
                                                                                            • Instruction Fuzzy Hash: 6F91A071A00259ABDF20EFA6D844FAEBBB8EF86714F148559F505AB280D7709941CFF0
                                                                                            Function 00DD1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00DD125C
                                                                                            • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00DD1284
                                                                                            • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00DD12A8
                                                                                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DD12D8
                                                                                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DD135F
                                                                                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DD13C4
                                                                                            • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DD1430
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                                            • String ID:
                                                                                            • API String ID: 2550207440-0
                                                                                            • Opcode ID: 02d092c081baa13578d509f34a611f1f49585063b0bf73be31f81166d67943cb
                                                                                            • Instruction ID: 76e880457fd75fa4580be1e6e029b88f17365b813201545445c08042c65f1b2a
                                                                                            • Opcode Fuzzy Hash: 02d092c081baa13578d509f34a611f1f49585063b0bf73be31f81166d67943cb
                                                                                            • Instruction Fuzzy Hash: A391BF79A00208AFDB109F98C885BBE7BB5FF45314F14802AE940E7391D775A945CBB4
                                                                                            Function 00D7948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ObjectSelect$BeginCreatePath
                                                                                            • String ID:
                                                                                            • API String ID: 3225163088-0
                                                                                            • Opcode ID: 5770346c43ae62b03802de3438400479d1f77d04af7367ff7e9c7e1f67c6a1ef
                                                                                            • Instruction ID: 0a9538ac93a1e503a7957d4ddf21a22722d7784e044c30cdaac04912b5857b73
                                                                                            • Opcode Fuzzy Hash: 5770346c43ae62b03802de3438400479d1f77d04af7367ff7e9c7e1f67c6a1ef
                                                                                            • Instruction Fuzzy Hash: A6911572D04219EFCB10CFA9C894AEEBBB8FF89320F148559E515B7251E774A942CB70
                                                                                            Function 00DE3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DE396B
                                                                                            • CharUpperBuffW.USER32(?,?), ref: 00DE3A7A
                                                                                            • _wcslen.LIBCMT ref: 00DE3A8A
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DE3C1F
                                                                                              • Part of subcall function 00DD0CDF: VariantInit.OLEAUT32(00000000), ref: 00DD0D1F
                                                                                              • Part of subcall function 00DD0CDF: VariantCopy.OLEAUT32(?,?), ref: 00DD0D28
                                                                                              • Part of subcall function 00DD0CDF: VariantClear.OLEAUT32(?), ref: 00DD0D34
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                                            • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                            • API String ID: 4137639002-1221869570
                                                                                            • Opcode ID: c07513c3ea7aa5902263dc088e1e7ede471072b780c764fefa2cbd3a1c83571b
                                                                                            • Instruction ID: d472e8d898dd52d2d9d63d01c2fe25204c1bd91650c90e2592c60a0c56497ffe
                                                                                            • Opcode Fuzzy Hash: c07513c3ea7aa5902263dc088e1e7ede471072b780c764fefa2cbd3a1c83571b
                                                                                            • Instruction Fuzzy Hash: BE9167746083459FC714EF29C48596AB7E4FF88314F14886EF88A9B351DB31EE45CBA2
                                                                                            Function 00DE4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?,?,00DC035E), ref: 00DC002B
                                                                                              • Part of subcall function 00DC000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?), ref: 00DC0046
                                                                                              • Part of subcall function 00DC000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?), ref: 00DC0054
                                                                                              • Part of subcall function 00DC000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?), ref: 00DC0064
                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00DE4C51
                                                                                            • _wcslen.LIBCMT ref: 00DE4D59
                                                                                            • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00DE4DCF
                                                                                            • CoTaskMemFree.OLE32(?), ref: 00DE4DDA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                                            • String ID: NULL Pointer assignment
                                                                                            • API String ID: 614568839-2785691316
                                                                                            • Opcode ID: 22d10836a35e325d787aa798320bfb5997f3b98e164a03f756b4f41599795363
                                                                                            • Instruction ID: 9939086fa9fa7690bd0d95e3fcf5eabefa243f682bd8d594c99e97a02a27791c
                                                                                            • Opcode Fuzzy Hash: 22d10836a35e325d787aa798320bfb5997f3b98e164a03f756b4f41599795363
                                                                                            • Instruction Fuzzy Hash: F391F471D00259ABDF14EFA5C891AEEB7B9FF08314F10816AE915A7251EB709A44CFB0
                                                                                            Function 00DF20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenu.USER32(?), ref: 00DF2183
                                                                                            • GetMenuItemCount.USER32(00000000), ref: 00DF21B5
                                                                                            • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00DF21DD
                                                                                            • _wcslen.LIBCMT ref: 00DF2213
                                                                                            • GetMenuItemID.USER32(?,?), ref: 00DF224D
                                                                                            • GetSubMenu.USER32(?,?), ref: 00DF225B
                                                                                              • Part of subcall function 00DC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DC3A57
                                                                                              • Part of subcall function 00DC3A3D: GetCurrentThreadId.KERNEL32 ref: 00DC3A5E
                                                                                              • Part of subcall function 00DC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DC25B3), ref: 00DC3A65
                                                                                            • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00DF22E3
                                                                                              • Part of subcall function 00DCE97B: Sleep.KERNEL32 ref: 00DCE9F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 4196846111-0
                                                                                            • Opcode ID: c43427999d20f3525ccb3ba2943dcf2e732945ac8c649d2113544a3118ba9ac3
                                                                                            • Instruction ID: e14399f53fe3a344aeecda6979e7f685f789ccf88c5eadd331a4d1f69fbca4ee
                                                                                            • Opcode Fuzzy Hash: c43427999d20f3525ccb3ba2943dcf2e732945ac8c649d2113544a3118ba9ac3
                                                                                            • Instruction Fuzzy Hash: 09714C75A00209AFCB14DFA4C885ABEB7F5EF88310F15C459E956EB351DB34EA418BB0
                                                                                            Function 00DF7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsWindow.USER32(00F85558), ref: 00DF7F37
                                                                                            • IsWindowEnabled.USER32(00F85558), ref: 00DF7F43
                                                                                            • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00DF801E
                                                                                            • SendMessageW.USER32(00F85558,000000B0,?,?), ref: 00DF8051
                                                                                            • IsDlgButtonChecked.USER32(?,?), ref: 00DF8089
                                                                                            • GetWindowLongW.USER32(00F85558,000000EC), ref: 00DF80AB
                                                                                            • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00DF80C3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                                            • String ID:
                                                                                            • API String ID: 4072528602-0
                                                                                            • Opcode ID: ce5c8ba558632cf8c3f1adfe74efba2fa8696866ad34b514ce3068c8a903178e
                                                                                            • Instruction ID: 48b45e94605aec96fbf0c29a9681a409dbaae1942800c800a1f4a632df02c908
                                                                                            • Opcode Fuzzy Hash: ce5c8ba558632cf8c3f1adfe74efba2fa8696866ad34b514ce3068c8a903178e
                                                                                            • Instruction Fuzzy Hash: 8D71903460824DAFEB219F54CC84FFABBB5EF09300F198499EA4597261CB31A855DB31
                                                                                            Function 00DCAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(?), ref: 00DCAEF9
                                                                                            • GetKeyboardState.USER32(?), ref: 00DCAF0E
                                                                                            • SetKeyboardState.USER32(?), ref: 00DCAF6F
                                                                                            • PostMessageW.USER32(?,00000101,00000010,?), ref: 00DCAF9D
                                                                                            • PostMessageW.USER32(?,00000101,00000011,?), ref: 00DCAFBC
                                                                                            • PostMessageW.USER32(?,00000101,00000012,?), ref: 00DCAFFD
                                                                                            • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00DCB020
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                                            • String ID:
                                                                                            • API String ID: 87235514-0
                                                                                            • Opcode ID: b673fc309805388d5392f47d54602d0d90bb83d44f62ab21c3c05b27f2e32db3
                                                                                            • Instruction ID: 2f64e53aa6c7a87bbcaff7f316e74d7d5d6384ed178c685b4c877e40db3ac391
                                                                                            • Opcode Fuzzy Hash: b673fc309805388d5392f47d54602d0d90bb83d44f62ab21c3c05b27f2e32db3
                                                                                            • Instruction Fuzzy Hash: BC51B4A06047DA3DFB3642388846FBABEA95F06318F0C858EF1D5864D2C3A4DC84D771
                                                                                            Function 00DCACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetParent.USER32(00000000), ref: 00DCAD19
                                                                                            • GetKeyboardState.USER32(?), ref: 00DCAD2E
                                                                                            • SetKeyboardState.USER32(?), ref: 00DCAD8F
                                                                                            • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00DCADBB
                                                                                            • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00DCADD8
                                                                                            • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00DCAE17
                                                                                            • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00DCAE38
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePost$KeyboardState$Parent
                                                                                            • String ID:
                                                                                            • API String ID: 87235514-0
                                                                                            • Opcode ID: 4b3f0b167518c2ebbdf2c8be6f3fef6490efda896fe9c4e89779ca0e0365f586
                                                                                            • Instruction ID: 99a1bb4647b8bd05d008f5b10aafaa4b5dad0a9ae446c1f852dcb7e16069d38d
                                                                                            • Opcode Fuzzy Hash: 4b3f0b167518c2ebbdf2c8be6f3fef6490efda896fe9c4e89779ca0e0365f586
                                                                                            • Instruction Fuzzy Hash: 7651A3A16047DA3DFB3642288855F7ABE985B46308F0C858DF1D687882D294EC94D7B2
                                                                                            Function 00D9542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetConsoleCP.KERNEL32(00DA3CD6,?,?,?,?,?,?,?,?,00D95BA3,?,?,00DA3CD6,?,?), ref: 00D95470
                                                                                            • __fassign.LIBCMT ref: 00D954EB
                                                                                            • __fassign.LIBCMT ref: 00D95506
                                                                                            • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00DA3CD6,00000005,00000000,00000000), ref: 00D9552C
                                                                                            • WriteFile.KERNEL32(?,00DA3CD6,00000000,00D95BA3,00000000,?,?,?,?,?,?,?,?,?,00D95BA3,?), ref: 00D9554B
                                                                                            • WriteFile.KERNEL32(?,?,00000001,00D95BA3,00000000,?,?,?,?,?,?,?,?,?,00D95BA3,?), ref: 00D95584
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                            • String ID:
                                                                                            • API String ID: 1324828854-0
                                                                                            • Opcode ID: 28f6bd4db6d594330263a08a43e70ad9d28409cd9f9dc1ddff209b3096b51584
                                                                                            • Instruction ID: a4af79da0e4610c4a08b5d58a791f2dfaada343a615b125154e0d8d1bf13e8f2
                                                                                            • Opcode Fuzzy Hash: 28f6bd4db6d594330263a08a43e70ad9d28409cd9f9dc1ddff209b3096b51584
                                                                                            • Instruction Fuzzy Hash: 0B51B170A00609AFDF11DFA8E845AEEBBF9EF09300F15412AE555E7292D730DA51CB70
                                                                                            Function 00D82D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00D82D4B
                                                                                            • ___except_validate_context_record.LIBVCRUNTIME ref: 00D82D53
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00D82DE1
                                                                                            • __IsNonwritableInCurrentImage.LIBCMT ref: 00D82E0C
                                                                                            • _ValidateLocalCookies.LIBCMT ref: 00D82E61
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                            • String ID: csm
                                                                                            • API String ID: 1170836740-1018135373
                                                                                            • Opcode ID: 2dd67da5e72623629adccf4312b5a3ed843fd4cf5a1a604b4dd3ba8201a14cb0
                                                                                            • Instruction ID: 1cb76cda08f92137eaa88a9d9bc638068862e2dfde65d0a51fceba51d9d5ff5e
                                                                                            • Opcode Fuzzy Hash: 2dd67da5e72623629adccf4312b5a3ed843fd4cf5a1a604b4dd3ba8201a14cb0
                                                                                            • Instruction Fuzzy Hash: 73419234A00209ABCF10EF68C845AAEBFB5FF45324F188155E8186B392D735DA45CBF0
                                                                                            Function 00DE10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DE307A
                                                                                              • Part of subcall function 00DE304E: _wcslen.LIBCMT ref: 00DE309B
                                                                                            • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00DE1112
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1121
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE11C9
                                                                                            • closesocket.WSOCK32(00000000), ref: 00DE11F9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                                            • String ID:
                                                                                            • API String ID: 2675159561-0
                                                                                            • Opcode ID: 203ae2f86900ffcfcdf902d0771f13c9a269fe97b5a94828efca7f8ce213d23c
                                                                                            • Instruction ID: 557fba98f3ac9315b8fbf6f1193e8435c662f5aa9d494f9cc6a2d840cc967b1f
                                                                                            • Opcode Fuzzy Hash: 203ae2f86900ffcfcdf902d0771f13c9a269fe97b5a94828efca7f8ce213d23c
                                                                                            • Instruction Fuzzy Hash: 3041C035600348AFDB10AF55C884BAABBA9EF85364F188059FD56DB291C770ED81CBB1
                                                                                            Function 00DCCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DCCF22,?), ref: 00DCDDFD
                                                                                              • Part of subcall function 00DCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DCCF22,?), ref: 00DCDE16
                                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 00DCCF45
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 00DCCF7F
                                                                                            • _wcslen.LIBCMT ref: 00DCD005
                                                                                            • _wcslen.LIBCMT ref: 00DCD01B
                                                                                            • SHFileOperationW.SHELL32(?), ref: 00DCD061
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                                            • String ID: \*.*
                                                                                            • API String ID: 3164238972-1173974218
                                                                                            • Opcode ID: 3206ff69354a871da2b2fac406131a9de4331aec533770f34f49cc8f101febd1
                                                                                            • Instruction ID: 9f503b1b3bf33527e3c1c13c02bcacf4955f0274f81084b410b1e3db0a6a0a11
                                                                                            • Opcode Fuzzy Hash: 3206ff69354a871da2b2fac406131a9de4331aec533770f34f49cc8f101febd1
                                                                                            • Instruction Fuzzy Hash: 9A4153718062195FDF12EBA4C981FDDB7B9EF48380F1410EEE609EB141EA34A645CB70
                                                                                            Function 00DF2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00DF2E1C
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF2E4F
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF2E84
                                                                                            • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00DF2EB6
                                                                                            • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00DF2EE0
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF2EF1
                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DF2F0B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LongWindow$MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 2178440468-0
                                                                                            • Opcode ID: 889bb94aff43f379b2126d9454b21fe37f4215536ac784f133169db637076f79
                                                                                            • Instruction ID: 55279f44b8b9d4942320b9b6c4da2f12b0e31f829c82d62542b255312b86d2fd
                                                                                            • Opcode Fuzzy Hash: 889bb94aff43f379b2126d9454b21fe37f4215536ac784f133169db637076f79
                                                                                            • Instruction Fuzzy Hash: 853118306542489FDB208F19DD84F753BE0EB89710F2A81A4FA00DF2B1C771A854DB21
                                                                                            Function 00DC7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DC7769
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DC778F
                                                                                            • SysAllocString.OLEAUT32(00000000), ref: 00DC7792
                                                                                            • SysAllocString.OLEAUT32(?), ref: 00DC77B0
                                                                                            • SysFreeString.OLEAUT32(?), ref: 00DC77B9
                                                                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 00DC77DE
                                                                                            • SysAllocString.OLEAUT32(?), ref: 00DC77EC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                            • String ID:
                                                                                            • API String ID: 3761583154-0
                                                                                            • Opcode ID: dccfec9ee2b2b3b8e977c72f3a337224d817e40d923c261bfb61f50ac28b115f
                                                                                            • Instruction ID: b692f19d4983df85a974a5417b2d5f2a64706ab5794f6caccd434cc1938af53d
                                                                                            • Opcode Fuzzy Hash: dccfec9ee2b2b3b8e977c72f3a337224d817e40d923c261bfb61f50ac28b115f
                                                                                            • Instruction Fuzzy Hash: 4821817660421EAFDB10DFA8CD88DBB77ACEB097647048029F915DB290D670EC55CBB4
                                                                                            Function 00DC77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DC7842
                                                                                            • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DC7868
                                                                                            • SysAllocString.OLEAUT32(00000000), ref: 00DC786B
                                                                                            • SysAllocString.OLEAUT32 ref: 00DC788C
                                                                                            • SysFreeString.OLEAUT32 ref: 00DC7895
                                                                                            • StringFromGUID2.OLE32(?,?,00000028), ref: 00DC78AF
                                                                                            • SysAllocString.OLEAUT32(?), ref: 00DC78BD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                            • String ID:
                                                                                            • API String ID: 3761583154-0
                                                                                            • Opcode ID: b09b4a20bb11119980f4dee7e66adfb92d2a42369fd1934d95aa2aebdfcc8b54
                                                                                            • Instruction ID: cf5317125fd6296450aedb049fedc2ffa9000ba1bb63d30b02294a9c1f8ed344
                                                                                            • Opcode Fuzzy Hash: b09b4a20bb11119980f4dee7e66adfb92d2a42369fd1934d95aa2aebdfcc8b54
                                                                                            • Instruction Fuzzy Hash: 3E213035608209AFDF109FA8DC89EBA77ECEF097607148129FA15CB2A1D674EC41DB74
                                                                                            Function 00DD04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(0000000C), ref: 00DD04F2
                                                                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DD052E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateHandlePipe
                                                                                            • String ID: nul
                                                                                            • API String ID: 1424370930-2873401336
                                                                                            • Opcode ID: 54d430e7f63ad95ba83a41a0501a6d32c7d8e52a79a1e67b551a92277fdc2e34
                                                                                            • Instruction ID: 876a7e22cca330ff7294206c69ddd54dfb9f8adf2b0586b32879451ca14f334e
                                                                                            • Opcode Fuzzy Hash: 54d430e7f63ad95ba83a41a0501a6d32c7d8e52a79a1e67b551a92277fdc2e34
                                                                                            • Instruction Fuzzy Hash: 88215E75900305EBDB209F29E845BAA7BB4AF84724F244A1AECA1D73E0D770D950DF30
                                                                                            Function 00DD05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetStdHandle.KERNEL32(000000F6), ref: 00DD05C6
                                                                                            • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DD0601
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateHandlePipe
                                                                                            • String ID: nul
                                                                                            • API String ID: 1424370930-2873401336
                                                                                            • Opcode ID: c5e14fbe1d4a0b6a7c44168355499dadac1ab15a1bb09a5e26aba60c1cfd03f9
                                                                                            • Instruction ID: aebe1d9b3452d76c1dc3269f04c8b296f29cdffec5057ed82744c846789454db
                                                                                            • Opcode Fuzzy Hash: c5e14fbe1d4a0b6a7c44168355499dadac1ab15a1bb09a5e26aba60c1cfd03f9
                                                                                            • Instruction Fuzzy Hash: 99214C755003059BDB209F799C04BAA7BE8AFD5720F244A1AE9A1E73E0D7B0D960CB70
                                                                                            Function 00DF40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D6604C
                                                                                              • Part of subcall function 00D6600E: GetStockObject.GDI32(00000011), ref: 00D66060
                                                                                              • Part of subcall function 00D6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D6606A
                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00DF4112
                                                                                            • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00DF411F
                                                                                            • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00DF412A
                                                                                            • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00DF4139
                                                                                            • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00DF4145
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                                                            • String ID: Msctls_Progress32
                                                                                            • API String ID: 1025951953-3636473452
                                                                                            • Opcode ID: 94053c00e723ae806abd640742ba77adaadb647574c938b2a3223e13630a4f5b
                                                                                            • Instruction ID: d2aa371c17d1d7a4aa902d1acc4a385bd0743521f8364fcb22e32b429783ff43
                                                                                            • Opcode Fuzzy Hash: 94053c00e723ae806abd640742ba77adaadb647574c938b2a3223e13630a4f5b
                                                                                            • Instruction Fuzzy Hash: A4115EB215021DBEEB119E64CC85EE77F5DEF08798F018111BB58A6150CA729C61DBB4
                                                                                            Function 00D9D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D9D7A3: _free.LIBCMT ref: 00D9D7CC
                                                                                            • _free.LIBCMT ref: 00D9D82D
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • _free.LIBCMT ref: 00D9D838
                                                                                            • _free.LIBCMT ref: 00D9D843
                                                                                            • _free.LIBCMT ref: 00D9D897
                                                                                            • _free.LIBCMT ref: 00D9D8A2
                                                                                            • _free.LIBCMT ref: 00D9D8AD
                                                                                            • _free.LIBCMT ref: 00D9D8B8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                            • Instruction ID: 6c59b59f9390ac36b4187d04fa3cf26522fbecc75e42a4a06644d9f0b9bf10f3
                                                                                            • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                                            • Instruction Fuzzy Hash: B811C671981B04BADF21BFF0CC46FDB7B9EEF05700F404825B29EA6592DB75A5058AB0
                                                                                            Function 00DCDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00DCDA74
                                                                                            • LoadStringW.USER32(00000000), ref: 00DCDA7B
                                                                                            • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00DCDA91
                                                                                            • LoadStringW.USER32(00000000), ref: 00DCDA98
                                                                                            • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00DCDADC
                                                                                            Strings
                                                                                            • %s (%d) : ==> %s: %s %s, xrefs: 00DCDAB9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleLoadModuleString$Message
                                                                                            • String ID: %s (%d) : ==> %s: %s %s
                                                                                            • API String ID: 4072794657-3128320259
                                                                                            • Opcode ID: 0e56de32976b8afee206644eb23f82d64de3c4d6b46562503446cf5cf25356bb
                                                                                            • Instruction ID: 7cd1624b8a40aeacd4a84f86559289ea72b21a4de7de000458c516ab2d4fbc58
                                                                                            • Opcode Fuzzy Hash: 0e56de32976b8afee206644eb23f82d64de3c4d6b46562503446cf5cf25356bb
                                                                                            • Instruction Fuzzy Hash: 0F0162F251030C7FE710ABA09E89EF7726CE708701F4055A5B746E2141E6749E948F74
                                                                                            Function 00DD096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedExchange.KERNEL32(00F7DF98,00F7DF98), ref: 00DD097B
                                                                                            • EnterCriticalSection.KERNEL32(00F7DF78,00000000), ref: 00DD098D
                                                                                            • TerminateThread.KERNEL32(?,000001F6), ref: 00DD099B
                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00DD09A9
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DD09B8
                                                                                            • InterlockedExchange.KERNEL32(00F7DF98,000001F6), ref: 00DD09C8
                                                                                            • LeaveCriticalSection.KERNEL32(00F7DF78), ref: 00DD09CF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                            • String ID:
                                                                                            • API String ID: 3495660284-0
                                                                                            • Opcode ID: 16be84103a1365a823fe03bb95aae61be522b430c034322d5ceb23bfe5dba0fc
                                                                                            • Instruction ID: 2c48fd448baf18b8502d1e56865d00d987021bca0620153d169b3167a8156117
                                                                                            • Opcode Fuzzy Hash: 16be84103a1365a823fe03bb95aae61be522b430c034322d5ceb23bfe5dba0fc
                                                                                            • Instruction Fuzzy Hash: A9F01932552A06ABD7415BA4EF88BE6BA29FF41702F486026F202D09A0C7749475DFB4
                                                                                            Function 00D65D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClientRect.USER32(?,?), ref: 00D65D30
                                                                                            • GetWindowRect.USER32(?,?), ref: 00D65D71
                                                                                            • ScreenToClient.USER32(?,?), ref: 00D65D99
                                                                                            • GetClientRect.USER32(?,?), ref: 00D65ED7
                                                                                            • GetWindowRect.USER32(?,?), ref: 00D65EF8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Rect$Client$Window$Screen
                                                                                            • String ID:
                                                                                            • API String ID: 1296646539-0
                                                                                            • Opcode ID: 61a37a653bb7ba872e115c1562ec23ae16647e64f63619f3f2c94ff588330986
                                                                                            • Instruction ID: 11d049f61964c36515257da09012193f1146cd9740f8372176944f9d5cb75b7a
                                                                                            • Opcode Fuzzy Hash: 61a37a653bb7ba872e115c1562ec23ae16647e64f63619f3f2c94ff588330986
                                                                                            • Instruction Fuzzy Hash: 22B16834A0074ADBDB10CFA8D4807EAB7F1FF58310F18951AE8A9D7254DB74EA91DB60
                                                                                            Function 00D901B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __allrem.LIBCMT ref: 00D900BA
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D900D6
                                                                                            • __allrem.LIBCMT ref: 00D900ED
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D9010B
                                                                                            • __allrem.LIBCMT ref: 00D90122
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D90140
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                            • String ID:
                                                                                            • API String ID: 1992179935-0
                                                                                            • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                                            • Instruction ID: 682431afb4f878b545160fa1a49323b39636821d200dd2110168b052d03cd7cd
                                                                                            • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                                            • Instruction Fuzzy Hash: 9081E476A00706AFEB24AF68DC41B6B77E9EF41724F28453AF551E7281E770D9048BB0
                                                                                            Function 00DE1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DE3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00DE101C,00000000,?,?,00000000), ref: 00DE3195
                                                                                            • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00DE1DC0
                                                                                            • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00DE1DE1
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1DF2
                                                                                            • inet_ntoa.WSOCK32(?), ref: 00DE1E8C
                                                                                            • htons.WSOCK32(?,?,?,?,?), ref: 00DE1EDB
                                                                                            • _strlen.LIBCMT ref: 00DE1F35
                                                                                              • Part of subcall function 00DC39E8: _strlen.LIBCMT ref: 00DC39F2
                                                                                              • Part of subcall function 00D66D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00D7CF58,?,?,?), ref: 00D66DBA
                                                                                              • Part of subcall function 00D66D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00D7CF58,?,?,?), ref: 00D66DED
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
                                                                                            • String ID:
                                                                                            • API String ID: 1923757996-0
                                                                                            • Opcode ID: d006e26275c4a0fd154139b34827c059e57bae140194b804373629a089760865
                                                                                            • Instruction ID: 885b2ae09a373b02bfc344de5bcbc6397a7991e6238c026498098ccaeea964db
                                                                                            • Opcode Fuzzy Hash: d006e26275c4a0fd154139b34827c059e57bae140194b804373629a089760865
                                                                                            • Instruction Fuzzy Hash: E7A1A235204380AFC324EF25C895F6A7BA5EF84318F58894CF4569B2A2DB71ED45CBB1
                                                                                            Function 00D961FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D882D9,00D882D9,?,?,?,00D9644F,00000001,00000001,8BE85006), ref: 00D96258
                                                                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00D9644F,00000001,00000001,8BE85006,?,?,?), ref: 00D962DE
                                                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D963D8
                                                                                            • __freea.LIBCMT ref: 00D963E5
                                                                                              • Part of subcall function 00D93820: RtlAllocateHeap.NTDLL(00000000,?,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6,?,00D61129), ref: 00D93852
                                                                                            • __freea.LIBCMT ref: 00D963EE
                                                                                            • __freea.LIBCMT ref: 00D96413
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                            • String ID:
                                                                                            • API String ID: 1414292761-0
                                                                                            • Opcode ID: c29484d08b376cb9d1544d1f9c2250af82b8b52d8cff302819329a810d9acb1c
                                                                                            • Instruction ID: cbdf3a13c60b5df0f2eb261b2017703ad00fdc3a01c95f41384926dc0b4168aa
                                                                                            • Opcode Fuzzy Hash: c29484d08b376cb9d1544d1f9c2250af82b8b52d8cff302819329a810d9acb1c
                                                                                            • Instruction Fuzzy Hash: D251AC72A10216ABEF269F64CC81EBF7BAAEB44750F1D4629F805D6190EB34DC50C7B0
                                                                                            Function 00DEBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DEB6AE,?,?), ref: 00DEC9B5
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DEC9F1
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA68
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA9E
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DEBCCA
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DEBD25
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEBD6A
                                                                                            • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00DEBD99
                                                                                            • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00DEBDF3
                                                                                            • RegCloseKey.ADVAPI32(?), ref: 00DEBDFF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                            • String ID:
                                                                                            • API String ID: 1120388591-0
                                                                                            • Opcode ID: 3f0fe5819bd5d20ad34367f00bf58e9aeab85a5591d4487db4d5588823f41eae
                                                                                            • Instruction ID: 1b016da5a2b921b4fdb8985fa680b26d404ce497c20ec1b3004ce3db86c1743b
                                                                                            • Opcode Fuzzy Hash: 3f0fe5819bd5d20ad34367f00bf58e9aeab85a5591d4487db4d5588823f41eae
                                                                                            • Instruction Fuzzy Hash: D0816F30118241AFD714EF24C895E2ABBE5FF84318F14855DF59A8B2A2DB31ED45CBB2
                                                                                            Function 00DBF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(00000035), ref: 00DBF7B9
                                                                                            • SysAllocString.OLEAUT32(00000001), ref: 00DBF860
                                                                                            • VariantCopy.OLEAUT32(00DBFA64,00000000), ref: 00DBF889
                                                                                            • VariantClear.OLEAUT32(00DBFA64), ref: 00DBF8AD
                                                                                            • VariantCopy.OLEAUT32(00DBFA64,00000000), ref: 00DBF8B1
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DBF8BB
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearCopy$AllocInitString
                                                                                            • String ID:
                                                                                            • API String ID: 3859894641-0
                                                                                            • Opcode ID: 142aa4c7614394dc6a746e338e3734536c99bb108111f1764213722a16d9a25f
                                                                                            • Instruction ID: 08ae368159545bcbe422ab8cf785211c2cbed0f3bd824bc4ba202637dcadddc9
                                                                                            • Opcode Fuzzy Hash: 142aa4c7614394dc6a746e338e3734536c99bb108111f1764213722a16d9a25f
                                                                                            • Instruction Fuzzy Hash: 3D51C136610310FACF24AB65DC95BADB3A8EF45710B249467E907DF291EB709C40CBB6
                                                                                            Function 00DD910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D67620: _wcslen.LIBCMT ref: 00D67625
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • GetOpenFileNameW.COMDLG32(00000058), ref: 00DD94E5
                                                                                            • _wcslen.LIBCMT ref: 00DD9506
                                                                                            • _wcslen.LIBCMT ref: 00DD952D
                                                                                            • GetSaveFileNameW.COMDLG32(00000058), ref: 00DD9585
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$FileName$OpenSave
                                                                                            • String ID: X
                                                                                            • API String ID: 83654149-3081909835
                                                                                            • Opcode ID: 2f21c860ff782f5b1542ccc7eb5fba614b05c4b314a492f14b4b2d11c1fb4799
                                                                                            • Instruction ID: ce944d4f1191dad10e1acd449b57bfa46a0d33a9aea004dee28c7869ce5b3fa9
                                                                                            • Opcode Fuzzy Hash: 2f21c860ff782f5b1542ccc7eb5fba614b05c4b314a492f14b4b2d11c1fb4799
                                                                                            • Instruction Fuzzy Hash: 12E15F715043409FD724EF24C891A6AB7E4FF85314F18856EE8899B3A2DB31DD45CBB1
                                                                                            Function 00D7920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • BeginPaint.USER32(?,?,?), ref: 00D79241
                                                                                            • GetWindowRect.USER32(?,?), ref: 00D792A5
                                                                                            • ScreenToClient.USER32(?,?), ref: 00D792C2
                                                                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D792D3
                                                                                            • EndPaint.USER32(?,?,?,?,?), ref: 00D79321
                                                                                            • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00DB71EA
                                                                                              • Part of subcall function 00D79339: BeginPath.GDI32(00000000), ref: 00D79357
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                                            • String ID:
                                                                                            • API String ID: 3050599898-0
                                                                                            • Opcode ID: 418e9526582617fae52507f7de6f2976e5eb2cf3cabf7212f5f1fe8480c617ca
                                                                                            • Instruction ID: 78f2a641d9cc6bfd55ca97995eaa8a3f178a89b2392be657df0f5546c55f8fad
                                                                                            • Opcode Fuzzy Hash: 418e9526582617fae52507f7de6f2976e5eb2cf3cabf7212f5f1fe8480c617ca
                                                                                            • Instruction Fuzzy Hash: 0F41A031104304EFD710DF25C898FBABBA8EB85360F144269F999D72A1D7319849DB71
                                                                                            Function 00DD07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InterlockedExchange.KERNEL32(?,000001F5), ref: 00DD080C
                                                                                            • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00DD0847
                                                                                            • EnterCriticalSection.KERNEL32(?), ref: 00DD0863
                                                                                            • LeaveCriticalSection.KERNEL32(?), ref: 00DD08DC
                                                                                            • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00DD08F3
                                                                                            • InterlockedExchange.KERNEL32(?,000001F6), ref: 00DD0921
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                                            • String ID:
                                                                                            • API String ID: 3368777196-0
                                                                                            • Opcode ID: 43f817537bfaa8f621eb998667630f0eba43ed362938a15cd3a7fa1354841bad
                                                                                            • Instruction ID: 6f70f0495147cd0514fbbb828b9119e00c1f23c413a83bbf5dd74d3f57c201e3
                                                                                            • Opcode Fuzzy Hash: 43f817537bfaa8f621eb998667630f0eba43ed362938a15cd3a7fa1354841bad
                                                                                            • Instruction Fuzzy Hash: BC414A71900205EBDF15AF54DC85A6A7BB8FF44310F1480A5FD04EA296D730DE65DBB4
                                                                                            Function 00DF81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00DBF3AB,00000000,?,?,00000000,?,00DB682C,00000004,00000000,00000000), ref: 00DF824C
                                                                                            • EnableWindow.USER32(?,00000000), ref: 00DF8272
                                                                                            • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00DF82D1
                                                                                            • ShowWindow.USER32(?,00000004), ref: 00DF82E5
                                                                                            • EnableWindow.USER32(?,00000001), ref: 00DF830B
                                                                                            • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00DF832F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Show$Enable$MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 642888154-0
                                                                                            • Opcode ID: ec426072b94b0540b4cc73003e3a24b31443292ba7cda6e65c799a5b51cd974c
                                                                                            • Instruction ID: 9f7e03bf0f597814e47a8c932f8d0477d7089ca15896e35a3f534e82076d5172
                                                                                            • Opcode Fuzzy Hash: ec426072b94b0540b4cc73003e3a24b31443292ba7cda6e65c799a5b51cd974c
                                                                                            • Instruction Fuzzy Hash: 4F41D430A0164CEFDB11CF15D899BF87BE0FB46714F1D81A9E6089B272CB31A845DB66
                                                                                            Function 00DC4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsWindowVisible.USER32(?), ref: 00DC4C95
                                                                                            • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00DC4CB2
                                                                                            • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00DC4CEA
                                                                                            • _wcslen.LIBCMT ref: 00DC4D08
                                                                                            • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00DC4D10
                                                                                            • _wcsstr.LIBVCRUNTIME ref: 00DC4D1A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                                            • String ID:
                                                                                            • API String ID: 72514467-0
                                                                                            • Opcode ID: 5eb9e9ebb75125759a3807346c5342d7000ffb3474b8c0daa157303d42f5942c
                                                                                            • Instruction ID: 407f3b4dc6d6a39c1b10fbdff6db373104a4d1be75752492df9a8014a84de243
                                                                                            • Opcode Fuzzy Hash: 5eb9e9ebb75125759a3807346c5342d7000ffb3474b8c0daa157303d42f5942c
                                                                                            • Instruction Fuzzy Hash: 0D21F9326042057BEB256B399D59F7B7BACDF45750F14802DF80ACB1A1EA61DC10D7B0
                                                                                            Function 00DD581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D63A97,?,?,00D62E7F,?,?,?,00000000), ref: 00D63AC2
                                                                                            • _wcslen.LIBCMT ref: 00DD587B
                                                                                            • CoInitialize.OLE32(00000000), ref: 00DD5995
                                                                                            • CoCreateInstance.OLE32(00DFFCF8,00000000,00000001,00DFFB68,?), ref: 00DD59AE
                                                                                            • CoUninitialize.OLE32 ref: 00DD59CC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                                            • String ID: .lnk
                                                                                            • API String ID: 3172280962-24824748
                                                                                            • Opcode ID: 616bb7e1a6c71eb022e620e6e62fd309dd1763cecf4327fc07edc0d5df656d75
                                                                                            • Instruction ID: 4482c02dc036825d6776b5bb7975909d7e3813227be13663d90addf2d330e033
                                                                                            • Opcode Fuzzy Hash: 616bb7e1a6c71eb022e620e6e62fd309dd1763cecf4327fc07edc0d5df656d75
                                                                                            • Instruction Fuzzy Hash: 93D16470604701DFC714DF24D490A2ABBE1EF89724F15889EF88A9B361DB31EC45CBA2
                                                                                            Function 00DC175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DC0FCA
                                                                                              • Part of subcall function 00DC0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DC0FD6
                                                                                              • Part of subcall function 00DC0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DC0FE5
                                                                                              • Part of subcall function 00DC0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DC0FEC
                                                                                              • Part of subcall function 00DC0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DC1002
                                                                                            • GetLengthSid.ADVAPI32(?,00000000,00DC1335), ref: 00DC17AE
                                                                                            • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00DC17BA
                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 00DC17C1
                                                                                            • CopySid.ADVAPI32(00000000,00000000,?), ref: 00DC17DA
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00DC1335), ref: 00DC17EE
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC17F5
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                                            • String ID:
                                                                                            • API String ID: 3008561057-0
                                                                                            • Opcode ID: f52b450e90278177097f961febf81d5f3be6067ff9099da2d624322230e7c915
                                                                                            • Instruction ID: addc25ac371c5ef4a89b5e8aeca7ca3fa53498e155d40aea8c799d7972960fea
                                                                                            • Opcode Fuzzy Hash: f52b450e90278177097f961febf81d5f3be6067ff9099da2d624322230e7c915
                                                                                            • Instruction Fuzzy Hash: AB11A63661031AEFDB108BA4DD48FAE7BA8EF42315F14801CF481E7292C736A965CB70
                                                                                            Function 00DC14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00DC14FF
                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00DC1506
                                                                                            • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00DC1515
                                                                                            • CloseHandle.KERNEL32(00000004), ref: 00DC1520
                                                                                            • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DC154F
                                                                                            • DestroyEnvironmentBlock.USERENV(00000000), ref: 00DC1563
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                            • String ID:
                                                                                            • API String ID: 1413079979-0
                                                                                            • Opcode ID: 5e1dfa7b51fb2b5f22c0c9cb5a98c383ad73589e943e03442e8b9117135767c9
                                                                                            • Instruction ID: bf6d951f86045888c132772ad0bc4b62b691b6d65d61d9b367322d557a48a6fa
                                                                                            • Opcode Fuzzy Hash: 5e1dfa7b51fb2b5f22c0c9cb5a98c383ad73589e943e03442e8b9117135767c9
                                                                                            • Instruction Fuzzy Hash: 3611477651020EABDB118F98DE49FEE7BA9EF49744F088018FA05A2160C371CE65EB70
                                                                                            Function 00D83382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,00D83379,00D82FE5), ref: 00D83390
                                                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D8339E
                                                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D833B7
                                                                                            • SetLastError.KERNEL32(00000000,?,00D83379,00D82FE5), ref: 00D83409
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLastValue___vcrt_
                                                                                            • String ID:
                                                                                            • API String ID: 3852720340-0
                                                                                            • Opcode ID: 2e452c7ac065dfa46caaca443109922fa104de24100ce4ac739fe6b7612fec9e
                                                                                            • Instruction ID: d8d8743ec55d2240230f1b5d5b760debd9dbed0f7889b89b991650d1f9309e35
                                                                                            • Opcode Fuzzy Hash: 2e452c7ac065dfa46caaca443109922fa104de24100ce4ac739fe6b7612fec9e
                                                                                            • Instruction Fuzzy Hash: A0012432208311BEAB2437BDFC86E2A2A94EB05B793300229F418902F0EF114E0697B4
                                                                                            Function 00D92D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,00D95686,00DA3CD6,?,00000000,?,00D95B6A,?,?,?,?,?,00D8E6D1,?,00E28A48), ref: 00D92D78
                                                                                            • _free.LIBCMT ref: 00D92DAB
                                                                                            • _free.LIBCMT ref: 00D92DD3
                                                                                            • SetLastError.KERNEL32(00000000,?,?,?,?,00D8E6D1,?,00E28A48,00000010,00D64F4A,?,?,00000000,00DA3CD6), ref: 00D92DE0
                                                                                            • SetLastError.KERNEL32(00000000,?,?,?,?,00D8E6D1,?,00E28A48,00000010,00D64F4A,?,?,00000000,00DA3CD6), ref: 00D92DEC
                                                                                            • _abort.LIBCMT ref: 00D92DF2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free$_abort
                                                                                            • String ID:
                                                                                            • API String ID: 3160817290-0
                                                                                            • Opcode ID: 50f23d243221a091d6181a925516aa896c3ce09afe135c9f9fe1ae2e671dfc61
                                                                                            • Instruction ID: ce82a10cd5f6194f758f39f7d7c2af7d658b9cf190059317fc8dc6ca6cf617d0
                                                                                            • Opcode Fuzzy Hash: 50f23d243221a091d6181a925516aa896c3ce09afe135c9f9fe1ae2e671dfc61
                                                                                            • Instruction Fuzzy Hash: 94F0A4355456003BCF227735BC0AE3E25A9EFC17B1F294519F828E2292EF24881281F0
                                                                                            Function 00DF8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D79693
                                                                                              • Part of subcall function 00D79639: SelectObject.GDI32(?,00000000), ref: 00D796A2
                                                                                              • Part of subcall function 00D79639: BeginPath.GDI32(?), ref: 00D796B9
                                                                                              • Part of subcall function 00D79639: SelectObject.GDI32(?,00000000), ref: 00D796E2
                                                                                            • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00DF8A4E
                                                                                            • LineTo.GDI32(?,00000003,00000000), ref: 00DF8A62
                                                                                            • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00DF8A70
                                                                                            • LineTo.GDI32(?,00000000,00000003), ref: 00DF8A80
                                                                                            • EndPath.GDI32(?), ref: 00DF8A90
                                                                                            • StrokePath.GDI32(?), ref: 00DF8AA0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                            • String ID:
                                                                                            • API String ID: 43455801-0
                                                                                            • Opcode ID: 52b4b22010cd5ae5d8ae9b57113807f7fe7c45140f0af7bec2309772e28a096f
                                                                                            • Instruction ID: e38c7763e22360fc04a8e970bcb4f00d73840788fc041c59b68d823c9890562b
                                                                                            • Opcode Fuzzy Hash: 52b4b22010cd5ae5d8ae9b57113807f7fe7c45140f0af7bec2309772e28a096f
                                                                                            • Instruction Fuzzy Hash: C6110C7600020DFFDB119F90DC48EAA7F6CEB04394F04C052BA19991A1D7719D65DB70
                                                                                            Function 00DC51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDC.USER32(00000000), ref: 00DC5218
                                                                                            • GetDeviceCaps.GDI32(00000000,00000058), ref: 00DC5229
                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DC5230
                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 00DC5238
                                                                                            • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00DC524F
                                                                                            • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00DC5261
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDevice$Release
                                                                                            • String ID:
                                                                                            • API String ID: 1035833867-0
                                                                                            • Opcode ID: e17e8c27bb2eb736c41e3d04adbe800917a48f9da503a2224875e1678e546fa5
                                                                                            • Instruction ID: 7e810aaa7c332bb40ea61a100dd3197d3409b1bbbe0dc51eb69ad3249bd3c0a2
                                                                                            • Opcode Fuzzy Hash: e17e8c27bb2eb736c41e3d04adbe800917a48f9da503a2224875e1678e546fa5
                                                                                            • Instruction Fuzzy Hash: 95018F75A00709BBEB109BE59D49F5EBFB8EF48351F048065FA04E7390DA709814CBB0
                                                                                            Function 00D61BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D61BF4
                                                                                            • MapVirtualKeyW.USER32(00000010,00000000), ref: 00D61BFC
                                                                                            • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D61C07
                                                                                            • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D61C12
                                                                                            • MapVirtualKeyW.USER32(00000011,00000000), ref: 00D61C1A
                                                                                            • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D61C22
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Virtual
                                                                                            • String ID:
                                                                                            • API String ID: 4278518827-0
                                                                                            • Opcode ID: 6a2cea8fb7c995e134f0d62f0cbdd1d38ce49ca37adcc4aaa3b057b0deaf91de
                                                                                            • Instruction ID: b16b5b1512bddd323bb54bca9f533d207c0063abebff3a2673446586503d264d
                                                                                            • Opcode Fuzzy Hash: 6a2cea8fb7c995e134f0d62f0cbdd1d38ce49ca37adcc4aaa3b057b0deaf91de
                                                                                            • Instruction Fuzzy Hash: 5B016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C87A41C7F5A864CBE5
                                                                                            Function 00DCEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DCEB30
                                                                                            • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00DCEB46
                                                                                            • GetWindowThreadProcessId.USER32(?,?), ref: 00DCEB55
                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DCEB64
                                                                                            • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DCEB6E
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DCEB75
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                            • String ID:
                                                                                            • API String ID: 839392675-0
                                                                                            • Opcode ID: 4bd6b49f2936521e463dc034f033edcd6e08668cd8fd0dc2549880d6a1e612b0
                                                                                            • Instruction ID: c82ca40589291cbfe84443788e5c544cedfe4d02fab73690342898e8fa1a99bb
                                                                                            • Opcode Fuzzy Hash: 4bd6b49f2936521e463dc034f033edcd6e08668cd8fd0dc2549880d6a1e612b0
                                                                                            • Instruction Fuzzy Hash: 05F0907221021CBBE72057529D0DEFF3A7CEFCAB11F009158F601D1290D7A01A21C6B4
                                                                                            Function 00DB7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetClientRect.USER32(?), ref: 00DB7452
                                                                                            • SendMessageW.USER32(?,00001328,00000000,?), ref: 00DB7469
                                                                                            • GetWindowDC.USER32(?), ref: 00DB7475
                                                                                            • GetPixel.GDI32(00000000,?,?), ref: 00DB7484
                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00DB7496
                                                                                            • GetSysColor.USER32(00000005), ref: 00DB74B0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                                                            • String ID:
                                                                                            • API String ID: 272304278-0
                                                                                            • Opcode ID: b59cecd58f24f4868f020d5e46ec7452746cf244d662fdd5c67ed55ce09670f3
                                                                                            • Instruction ID: a075b7484621dbc6981b00c8b62eeab274d13d3e053e93f0aedc97ecdd17f483
                                                                                            • Opcode Fuzzy Hash: b59cecd58f24f4868f020d5e46ec7452746cf244d662fdd5c67ed55ce09670f3
                                                                                            • Instruction Fuzzy Hash: CF018B31414209EFDB105F64DD08BFA7BB5FB04312F259064F916E22B0CB311E61EB60
                                                                                            Function 00DC1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DC187F
                                                                                            • UnloadUserProfile.USERENV(?,?), ref: 00DC188B
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DC1894
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DC189C
                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00DC18A5
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC18AC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                            • String ID:
                                                                                            • API String ID: 146765662-0
                                                                                            • Opcode ID: 34e4cca4485efdd787aaed66389b4e40cebe96c908bab6061219169823154de9
                                                                                            • Instruction ID: 5f516b90936fde1ad28c69c1e927abb980aa4cf05595f88c57b18a6342f3f093
                                                                                            • Opcode Fuzzy Hash: 34e4cca4485efdd787aaed66389b4e40cebe96c908bab6061219169823154de9
                                                                                            • Instruction Fuzzy Hash: 68E0C236114309BBDA016BA1EE0CD1ABF69FF59B22B10D220F225C1270CB329430EB60
                                                                                            Function 00D6BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __Init_thread_footer.LIBCMT ref: 00D6BEB3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Init_thread_footer
                                                                                            • String ID: D%$D%$D%$D%
                                                                                            • API String ID: 1385522511-2722557190
                                                                                            • Opcode ID: 7bc266a7fe8b0054fb50099d79c54bf00cce2cac81bdf4dd9aff092d9fc8ef79
                                                                                            • Instruction ID: d1e51f321297439f52c4747275010b2f069925e8eb19dae610323f31127c6e7d
                                                                                            • Opcode Fuzzy Hash: 7bc266a7fe8b0054fb50099d79c54bf00cce2cac81bdf4dd9aff092d9fc8ef79
                                                                                            • Instruction Fuzzy Hash: 7091F975A0060ADFCB14CF69C0916A9BBF1FF58324F25416AD986EB351D731EA81CFA0
                                                                                            Function 00DCC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D67620: _wcslen.LIBCMT ref: 00D67625
                                                                                            • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DCC6EE
                                                                                            • _wcslen.LIBCMT ref: 00DCC735
                                                                                            • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DCC79C
                                                                                            • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00DCC7CA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ItemMenu$Info_wcslen$Default
                                                                                            • String ID: 0
                                                                                            • API String ID: 1227352736-4108050209
                                                                                            • Opcode ID: ebaee939b66e23ebcc2809cdb6a55e716cbe8cc349e04da5fbf4381ad356c0cf
                                                                                            • Instruction ID: 4f7ce108683908c1a715e3d41e61b864ec43ffa89244a62e612ec965db749a7c
                                                                                            • Opcode Fuzzy Hash: ebaee939b66e23ebcc2809cdb6a55e716cbe8cc349e04da5fbf4381ad356c0cf
                                                                                            • Instruction Fuzzy Hash: 99518F716243029BD7249F28C945F6A77E4EF85310F082A2DF699E31E0EB70D944CB72
                                                                                            Function 00DC719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00DC7206
                                                                                            • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00DC723C
                                                                                            • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00DC724D
                                                                                            • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00DC72CF
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                            • String ID: DllGetClassObject
                                                                                            • API String ID: 753597075-1075368562
                                                                                            • Opcode ID: 9e9592b613598e1b09c105a88515669c053d08fa1a081c9780e2ae86391aece1
                                                                                            • Instruction ID: e7b311f1b031e02675c799267aedef0147c5e229d212ce05c7cac0798616b6dc
                                                                                            • Opcode Fuzzy Hash: 9e9592b613598e1b09c105a88515669c053d08fa1a081c9780e2ae86391aece1
                                                                                            • Instruction Fuzzy Hash: D7413B71A04206AFDB15CF54C884FAABBA9EF44310F2580ADBD059F20AD7B1D945CFB4
                                                                                            Function 00DF3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DF3E35
                                                                                            • IsMenu.USER32(?), ref: 00DF3E4A
                                                                                            • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DF3E92
                                                                                            • DrawMenuBar.USER32 ref: 00DF3EA5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Item$DrawInfoInsert
                                                                                            • String ID: 0
                                                                                            • API String ID: 3076010158-4108050209
                                                                                            • Opcode ID: 15c13a9466b98d6d0bca39f1a6494fe54e536cb86cc2b5ba137481dcd4ec5b17
                                                                                            • Instruction ID: 6852a75a666ccb88be812ef8137e4ac509b36cebc7579a36d9e0649982aaa41d
                                                                                            • Opcode Fuzzy Hash: 15c13a9466b98d6d0bca39f1a6494fe54e536cb86cc2b5ba137481dcd4ec5b17
                                                                                            • Instruction Fuzzy Hash: 954149B5A0020DAFDF10DF54D884AEABBB5FF44350F0A8229FA05AB350D730AE54CB60
                                                                                            Function 00DC1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00DC1E66
                                                                                            • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00DC1E79
                                                                                            • SendMessageW.USER32(?,00000189,?,00000000), ref: 00DC1EA9
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$_wcslen$ClassName
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 2081771294-1403004172
                                                                                            • Opcode ID: bd6e3807c4732063328eb36af6257ae749637b9b4e749327692b4cce960597e4
                                                                                            • Instruction ID: e183cecad483c298edb93bfc930d785c734d07271b7e96bb7de45e0de2ba4adf
                                                                                            • Opcode Fuzzy Hash: bd6e3807c4732063328eb36af6257ae749637b9b4e749327692b4cce960597e4
                                                                                            • Instruction Fuzzy Hash: E5212175A00209ABDB14ABA4DD56DFFB7BCEF42350B14811DF825E32E2EB34491AC630
                                                                                            Function 00DEC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID: HKEY_LOCAL_MACHINE$HKLM
                                                                                            • API String ID: 176396367-4004644295
                                                                                            • Opcode ID: 090f3f8b343186517c1e5a41996dc19ea7a0954efeea7b317ed7f17bcb143e33
                                                                                            • Instruction ID: 02635e964132faeec3a3ca391ee3cb612866a12b385218d2fabd330be34b4ea7
                                                                                            • Opcode Fuzzy Hash: 090f3f8b343186517c1e5a41996dc19ea7a0954efeea7b317ed7f17bcb143e33
                                                                                            • Instruction Fuzzy Hash: 1F312873A201EA4BCB30FF2ED9415BF37919BA1754B1D6039E855AB244E670CD42D3B0
                                                                                            Function 00DF2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00DF2F8D
                                                                                            • LoadLibraryW.KERNEL32(?), ref: 00DF2F94
                                                                                            • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00DF2FA9
                                                                                            • DestroyWindow.USER32(?), ref: 00DF2FB1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                            • String ID: SysAnimate32
                                                                                            • API String ID: 3529120543-1011021900
                                                                                            • Opcode ID: a23e6675445b67fee33376eb99b22c0b1a3ee65c38a86857cfb08890ecbc7d12
                                                                                            • Instruction ID: 7f0c069f4a54d6bb4edcc2134dc59026df70eb4633567ed438a8447d98800e49
                                                                                            • Opcode Fuzzy Hash: a23e6675445b67fee33376eb99b22c0b1a3ee65c38a86857cfb08890ecbc7d12
                                                                                            • Instruction Fuzzy Hash: A121AC7122420DABEB104FA6DC80EBB37B9EF59368F168628FB54D21A0D771DC919770
                                                                                            Function 00D84D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D84D1E,00D928E9,?,00D84CBE,00D928E9,00E288B8,0000000C,00D84E15,00D928E9,00000002), ref: 00D84D8D
                                                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D84DA0
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,00D84D1E,00D928E9,?,00D84CBE,00D928E9,00E288B8,0000000C,00D84E15,00D928E9,00000002,00000000), ref: 00D84DC3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                            • API String ID: 4061214504-1276376045
                                                                                            • Opcode ID: 08cc7435fa88b9b1331dc2cb783c4d29b2e6522cca3e1970121957d969877300
                                                                                            • Instruction ID: 10ba192d96285e159975dc3b79071336e594f2401ac1f998982f6bd963796bae
                                                                                            • Opcode Fuzzy Hash: 08cc7435fa88b9b1331dc2cb783c4d29b2e6522cca3e1970121957d969877300
                                                                                            • Instruction Fuzzy Hash: D4F0AF30A1030DBBDB10AF90DD09BADBFB5EF04755F0840A5F809E22A0CF305994CBA0
                                                                                            Function 00DBD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32 ref: 00DBD3AD
                                                                                            • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00DBD3BF
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00DBD3E5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeLoadProc
                                                                                            • String ID: GetSystemWow64DirectoryW$X64
                                                                                            • API String ID: 145871493-2590602151
                                                                                            • Opcode ID: d5ac5b4e963f946c0833eeb53877eecd2ef84d6176a3b6522bd443ee029e3481
                                                                                            • Instruction ID: 33347b97be6e269a4aecab2b210b14ba953e03f5e704de1896b05072c5551611
                                                                                            • Opcode Fuzzy Hash: d5ac5b4e963f946c0833eeb53877eecd2ef84d6176a3b6522bd443ee029e3481
                                                                                            • Instruction Fuzzy Hash: C9F02030405725DBC7301B108C289B93262AF00701B59E069E847E2215FB20CDA4C6B6
                                                                                            Function 00D64E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D64EDD,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E9C
                                                                                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D64EAE
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00D64EDD,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64EC0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeLoadProc
                                                                                            • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                            • API String ID: 145871493-3689287502
                                                                                            • Opcode ID: d373aacaad395b59a883aebf4c86ead2b37aa1ea228c98b1269a8506bd05a94d
                                                                                            • Instruction ID: 731a3d824889e5852ca1a67d2f95ba5331b852d85c2c42bc1b91a2abcdf0f221
                                                                                            • Opcode Fuzzy Hash: d373aacaad395b59a883aebf4c86ead2b37aa1ea228c98b1269a8506bd05a94d
                                                                                            • Instruction Fuzzy Hash: 00E07236E127325BC2320B24BE08B3F6268AF81F62B096010FC00E2302CF60CC21C0B0
                                                                                            Function 00D64E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DA3CDE,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E62
                                                                                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D64E74
                                                                                            • FreeLibrary.KERNEL32(00000000,?,?,00DA3CDE,?,00E31418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D64E87
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Library$AddressFreeLoadProc
                                                                                            • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                            • API String ID: 145871493-1355242751
                                                                                            • Opcode ID: 0d811ccee51712459de52a99ed7f5b89dec7ab330c9b7df62a2c28c1f6299e0b
                                                                                            • Instruction ID: 9b8425a953249442ddf3fc38cd71e9beca0d0e9bd15aec6baddb28e9611d9586
                                                                                            • Opcode Fuzzy Hash: 0d811ccee51712459de52a99ed7f5b89dec7ab330c9b7df62a2c28c1f6299e0b
                                                                                            • Instruction Fuzzy Hash: 0BD0C2395127365B46221B247C08DAB2A18AF81B153099111B904E2211CF21CD21C5F0
                                                                                            Function 00DD2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DD2C05
                                                                                            • DeleteFileW.KERNEL32(?), ref: 00DD2C87
                                                                                            • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DD2C9D
                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DD2CAE
                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DD2CC0
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$Delete$Copy
                                                                                            • String ID:
                                                                                            • API String ID: 3226157194-0
                                                                                            • Opcode ID: b3fea4defd5b84508bf4bacd522a5f3c0af555e07c1da86dc8524b9badfe7884
                                                                                            • Instruction ID: da6afd3400c41d994641776e65d81b409eb9125cd308a9f00463ee889a1c3401
                                                                                            • Opcode Fuzzy Hash: b3fea4defd5b84508bf4bacd522a5f3c0af555e07c1da86dc8524b9badfe7884
                                                                                            • Instruction Fuzzy Hash: 1FB13D72900119ABDF21EBA4CC85EEEB7BDEF59350F1040A6F509E7255EA309E448F71
                                                                                            Function 00DEA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentProcessId.KERNEL32 ref: 00DEA427
                                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00DEA435
                                                                                            • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00DEA468
                                                                                            • CloseHandle.KERNEL32(?), ref: 00DEA63D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                            • String ID:
                                                                                            • API String ID: 3488606520-0
                                                                                            • Opcode ID: d82ef65399e248e717ce613818b4887093c499c3bb0fd1fba9dd9f1fe9aa112e
                                                                                            • Instruction ID: 1438d0daaed80ac68571ab1f8dde2f6e7368bd1876fb2bcfefd5c6f72883ac5c
                                                                                            • Opcode Fuzzy Hash: d82ef65399e248e717ce613818b4887093c499c3bb0fd1fba9dd9f1fe9aa112e
                                                                                            • Instruction Fuzzy Hash: 68A191716047019FD720EF18C886B2AB7E1EF84714F18885DF59ADB2D2D7B0EC418BA1
                                                                                            Function 00DCE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DCCF22,?), ref: 00DCDDFD
                                                                                              • Part of subcall function 00DCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DCCF22,?), ref: 00DCDE16
                                                                                              • Part of subcall function 00DCE199: GetFileAttributesW.KERNEL32(?,00DCCF95), ref: 00DCE19A
                                                                                            • lstrcmpiW.KERNEL32(?,?), ref: 00DCE473
                                                                                            • MoveFileW.KERNEL32(?,?), ref: 00DCE4AC
                                                                                            • _wcslen.LIBCMT ref: 00DCE5EB
                                                                                            • _wcslen.LIBCMT ref: 00DCE603
                                                                                            • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00DCE650
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                                            • String ID:
                                                                                            • API String ID: 3183298772-0
                                                                                            • Opcode ID: d4fbb040da95d70a6281fce49b367498ed5e8a3b0cac477fb57c71597b2e6ee5
                                                                                            • Instruction ID: 0c71fcf7ba24f0c8dcce18a82b848241fb8f86001ecbd24ac23b2f89c0123c6c
                                                                                            • Opcode Fuzzy Hash: d4fbb040da95d70a6281fce49b367498ed5e8a3b0cac477fb57c71597b2e6ee5
                                                                                            • Instruction Fuzzy Hash: C45130F24087455BC724EB90D891EDBB3ECEF85340F04492EF689D3191EE74A6888776
                                                                                            Function 00DEB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DEB6AE,?,?), ref: 00DEC9B5
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DEC9F1
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA68
                                                                                              • Part of subcall function 00DEC998: _wcslen.LIBCMT ref: 00DECA9E
                                                                                            • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DEBAA5
                                                                                            • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DEBB00
                                                                                            • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00DEBB63
                                                                                            • RegCloseKey.ADVAPI32(?,?), ref: 00DEBBA6
                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00DEBBB3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                            • String ID:
                                                                                            • API String ID: 826366716-0
                                                                                            • Opcode ID: c4c0d0c218b08b658f99c69935011e4b63ecfe6f86842a95783671e6cb84e8ac
                                                                                            • Instruction ID: 0f01a306a5c327cedc7eed65914fa4e65f0393058cdc6ec7d44cf7fbc6936b13
                                                                                            • Opcode Fuzzy Hash: c4c0d0c218b08b658f99c69935011e4b63ecfe6f86842a95783671e6cb84e8ac
                                                                                            • Instruction Fuzzy Hash: 48617E31108241AFD714EF15C490E2BBBE5FF84318F54856DF4998B2A2DB31ED45CBA2
                                                                                            Function 00DC8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • VariantInit.OLEAUT32(?), ref: 00DC8BCD
                                                                                            • VariantClear.OLEAUT32 ref: 00DC8C3E
                                                                                            • VariantClear.OLEAUT32 ref: 00DC8C9D
                                                                                            • VariantClear.OLEAUT32(?), ref: 00DC8D10
                                                                                            • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00DC8D3B
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$Clear$ChangeInitType
                                                                                            • String ID:
                                                                                            • API String ID: 4136290138-0
                                                                                            • Opcode ID: fdae7a5587ddc321b7b4c32436e3e391be453b29e6e611d6e242f715746f93a7
                                                                                            • Instruction ID: 52efdb014faded2e6b1da934a3945f1b020b8a0df9783bbc401db828d4b17f4e
                                                                                            • Opcode Fuzzy Hash: fdae7a5587ddc321b7b4c32436e3e391be453b29e6e611d6e242f715746f93a7
                                                                                            • Instruction Fuzzy Hash: A2515BB5A0021AEFCB14CF58D894EAAB7F8FF89310B158559F906DB350E730E911CBA0
                                                                                            Function 00DD8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00DD8BAE
                                                                                            • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00DD8BDA
                                                                                            • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00DD8C32
                                                                                            • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00DD8C57
                                                                                            • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00DD8C5F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: PrivateProfile$SectionWrite$String
                                                                                            • String ID:
                                                                                            • API String ID: 2832842796-0
                                                                                            • Opcode ID: 4162bd236e507ecf03d1e8f842a94e7b5ebf7cad0681a78946282e35873847c9
                                                                                            • Instruction ID: 996c277c58e8192e55cc2f44ba7e4096e6e7bb9513ae92abafc90910f3f3111b
                                                                                            • Opcode Fuzzy Hash: 4162bd236e507ecf03d1e8f842a94e7b5ebf7cad0681a78946282e35873847c9
                                                                                            • Instruction Fuzzy Hash: 42514A35A10219DFCB15DF64C881A69BBF5FF48314F088499E84AAB362DB31ED51DBB0
                                                                                            Function 00DE8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00DE8F40
                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00DE8FD0
                                                                                            • GetProcAddress.KERNEL32(00000000,00000000), ref: 00DE8FEC
                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00DE9032
                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 00DE9052
                                                                                              • Part of subcall function 00D7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00DD1043,?,753CE610), ref: 00D7F6E6
                                                                                              • Part of subcall function 00D7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00DBFA64,00000000,00000000,?,?,00DD1043,?,753CE610,?,00DBFA64), ref: 00D7F70D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                                            • String ID:
                                                                                            • API String ID: 666041331-0
                                                                                            • Opcode ID: 73483323888a98dd7c6604854a4966daef51b589026be731190fd4c20ec3e669
                                                                                            • Instruction ID: d6cea4b3b5a9a56f51b47dc6b50d9d288c2cd9963e8cb5efa861e8324a74875f
                                                                                            • Opcode Fuzzy Hash: 73483323888a98dd7c6604854a4966daef51b589026be731190fd4c20ec3e669
                                                                                            • Instruction Fuzzy Hash: 47514B35601245DFC711EF59C4948ADFBF1FF49324B4880A9E84AAB362DB31ED85CBA0
                                                                                            Function 00DF6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00DF6C33
                                                                                            • SetWindowLongW.USER32(?,000000EC,?), ref: 00DF6C4A
                                                                                            • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00DF6C73
                                                                                            • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00DDAB79,00000000,00000000), ref: 00DF6C98
                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00DF6CC7
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long$MessageSendShow
                                                                                            • String ID:
                                                                                            • API String ID: 3688381893-0
                                                                                            • Opcode ID: 4d4478ae65808ad044a48c671184b23ad12f984286074181092deacd0e1d78ed
                                                                                            • Instruction ID: fe1f7a7ed56fbf6ad00341a2d419bd4347a25620dd2b48414e41632e7c2cbf90
                                                                                            • Opcode Fuzzy Hash: 4d4478ae65808ad044a48c671184b23ad12f984286074181092deacd0e1d78ed
                                                                                            • Instruction Fuzzy Hash: D441A03560410CAFD7248F28CD58BB97FA5EB09350F1A8268FAD9E77A1C371ED51CA60
                                                                                            Function 00D92051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: 54620465be2584aa8f5108ee2516f51504ab4ec747a934f83487d6140801f884
                                                                                            • Instruction ID: d6b0f7ce0c508e1fcae99326aa3f47c675d9f4af51369f9d695cb294b4b36a21
                                                                                            • Opcode Fuzzy Hash: 54620465be2584aa8f5108ee2516f51504ab4ec747a934f83487d6140801f884
                                                                                            • Instruction Fuzzy Hash: 8141B232A00200AFCF24DF78C881A6DB7F5EF89314F194569E559EB355D731AD01CBA1
                                                                                            Function 00D7912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCursorPos.USER32(?), ref: 00D79141
                                                                                            • ScreenToClient.USER32(00000000,?), ref: 00D7915E
                                                                                            • GetAsyncKeyState.USER32(00000001), ref: 00D79183
                                                                                            • GetAsyncKeyState.USER32(00000002), ref: 00D7919D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: AsyncState$ClientCursorScreen
                                                                                            • String ID:
                                                                                            • API String ID: 4210589936-0
                                                                                            • Opcode ID: 32465689d0ea134add8ff28e73aa91d9193a23d18196f54282d9cf7cba7877cb
                                                                                            • Instruction ID: b78a826d04c28fc348733ce0374caedecb597d2720bfdb6235dbaf848226b421
                                                                                            • Opcode Fuzzy Hash: 32465689d0ea134add8ff28e73aa91d9193a23d18196f54282d9cf7cba7877cb
                                                                                            • Instruction Fuzzy Hash: 7A41903190860AFBDF059F68C854BFEF774FB45324F248219E829A7290D7345960CB71
                                                                                            Function 00DD3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetInputState.USER32 ref: 00DD38CB
                                                                                            • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00DD3922
                                                                                            • TranslateMessage.USER32(?), ref: 00DD394B
                                                                                            • DispatchMessageW.USER32(?), ref: 00DD3955
                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DD3966
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                                            • String ID:
                                                                                            • API String ID: 2256411358-0
                                                                                            • Opcode ID: b493f130d093919c02ad62b04450000ce0021220eb173ca8d14c5992bd3eed75
                                                                                            • Instruction ID: 539f8c96b82bfbcb8570309ef7c8c52442699eb40961c333c85b2bf7b7b6b1e3
                                                                                            • Opcode Fuzzy Hash: b493f130d093919c02ad62b04450000ce0021220eb173ca8d14c5992bd3eed75
                                                                                            • Instruction Fuzzy Hash: C63195705043459EEB35CB759C58BB63BA8AB05344F08456FE4A2D23A0E3F4A689DF32
                                                                                            Function 00DDCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00DDCF38
                                                                                            • InternetReadFile.WININET(?,00000000,?,?), ref: 00DDCF6F
                                                                                            • GetLastError.KERNEL32(?,00000000,?,?,?,00DDC21E,00000000), ref: 00DDCFB4
                                                                                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,00DDC21E,00000000), ref: 00DDCFC8
                                                                                            • SetEvent.KERNEL32(?,?,00000000,?,?,?,00DDC21E,00000000), ref: 00DDCFF2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                                            • String ID:
                                                                                            • API String ID: 3191363074-0
                                                                                            • Opcode ID: 57f79f51f7e9d7a2124043f4f76b5b40df5b81dfd6e071ef09f2a4dfa6eb7d70
                                                                                            • Instruction ID: 292716276f1075d2a06af5b4652ff97ff316db4c50d780c61d9929214b54d3f2
                                                                                            • Opcode Fuzzy Hash: 57f79f51f7e9d7a2124043f4f76b5b40df5b81dfd6e071ef09f2a4dfa6eb7d70
                                                                                            • Instruction Fuzzy Hash: 1C313C71525306AFDB20DFA5C9849AABBFAEF14350F14942EF546D2250EB30ED44DB70
                                                                                            Function 00DC1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DC1915
                                                                                            • PostMessageW.USER32(00000001,00000201,00000001), ref: 00DC19C1
                                                                                            • Sleep.KERNEL32(00000000,?,?,?), ref: 00DC19C9
                                                                                            • PostMessageW.USER32(00000001,00000202,00000000), ref: 00DC19DA
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00DC19E2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessagePostSleep$RectWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3382505437-0
                                                                                            • Opcode ID: 21a42096f3c6ebacd19860d0b5518f27a8ea64e44c0a11fd1a63ad80e0de019c
                                                                                            • Instruction ID: 48ff029f614b73b014fe9ac7aa85d0207b54d6de7b0dbfd47900b0e342d5c831
                                                                                            • Opcode Fuzzy Hash: 21a42096f3c6ebacd19860d0b5518f27a8ea64e44c0a11fd1a63ad80e0de019c
                                                                                            • Instruction Fuzzy Hash: 5C31A175A0022AEFCB10CFA8C959BEE7BB5EB05315F148229F961E72D1C7709954CFA0
                                                                                            Function 00DF5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00DF5745
                                                                                            • SendMessageW.USER32(?,00001074,?,00000001), ref: 00DF579D
                                                                                            • _wcslen.LIBCMT ref: 00DF57AF
                                                                                            • _wcslen.LIBCMT ref: 00DF57BA
                                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00DF5816
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 763830540-0
                                                                                            • Opcode ID: 3ca4f599326ac452eab0e9a6992f56722a60be3968240666e45344ab94006697
                                                                                            • Instruction ID: dfda743b236b7995582d978a853a5d6ad905f3e78c3d62c87eb51623cf795ed4
                                                                                            • Opcode Fuzzy Hash: 3ca4f599326ac452eab0e9a6992f56722a60be3968240666e45344ab94006697
                                                                                            • Instruction Fuzzy Hash: 7721737190461C9ADB209F60DC85AFD7BB8FF05724F14C256EB19EA194D7708985CF70
                                                                                            Function 00DE0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • IsWindow.USER32(00000000), ref: 00DE0951
                                                                                            • GetForegroundWindow.USER32 ref: 00DE0968
                                                                                            • GetDC.USER32(00000000), ref: 00DE09A4
                                                                                            • GetPixel.GDI32(00000000,?,00000003), ref: 00DE09B0
                                                                                            • ReleaseDC.USER32(00000000,00000003), ref: 00DE09E8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ForegroundPixelRelease
                                                                                            • String ID:
                                                                                            • API String ID: 4156661090-0
                                                                                            • Opcode ID: 215d13c5cdd8e4d116088abd402aee5470e55c73c5dfea37634d43027c9d71f0
                                                                                            • Instruction ID: 8fe1a32fb7574871ea5ae51b9c026ba357e9524a3c168dd62e8cefe001f41fd6
                                                                                            • Opcode Fuzzy Hash: 215d13c5cdd8e4d116088abd402aee5470e55c73c5dfea37634d43027c9d71f0
                                                                                            • Instruction Fuzzy Hash: 7D218E35600204AFD704EF69DD84AAEBBE9EF48700F048469F84AD7362DB70AD44CB70
                                                                                            Function 00D9CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetEnvironmentStringsW.KERNEL32 ref: 00D9CDC6
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D9CDE9
                                                                                              • Part of subcall function 00D93820: RtlAllocateHeap.NTDLL(00000000,?,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6,?,00D61129), ref: 00D93852
                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D9CE0F
                                                                                            • _free.LIBCMT ref: 00D9CE22
                                                                                            • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D9CE31
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                            • String ID:
                                                                                            • API String ID: 336800556-0
                                                                                            • Opcode ID: 63a781171dadac2faf5970551d646259cb11edfd1fed7df11e38e2f80aea973d
                                                                                            • Instruction ID: aa0a59fc6aa5339b365439bbe576f44c309240f1b2246100c2bc715f4c8c743f
                                                                                            • Opcode Fuzzy Hash: 63a781171dadac2faf5970551d646259cb11edfd1fed7df11e38e2f80aea973d
                                                                                            • Instruction Fuzzy Hash: AD01A7726213157F2B2157B66C8CD7B796DDEC6BA13195129FD06C7201EA618D11C2F0
                                                                                            Function 00D79639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D79693
                                                                                            • SelectObject.GDI32(?,00000000), ref: 00D796A2
                                                                                            • BeginPath.GDI32(?), ref: 00D796B9
                                                                                            • SelectObject.GDI32(?,00000000), ref: 00D796E2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ObjectSelect$BeginCreatePath
                                                                                            • String ID:
                                                                                            • API String ID: 3225163088-0
                                                                                            • Opcode ID: 26800452dbc97e7387a556c4d9c675b6f0eaae040507a43ba61ad6f87429c469
                                                                                            • Instruction ID: f72dbaf0b7869f160d169ead9b02411ab812f930c22df70a409faebb23ed64b6
                                                                                            • Opcode Fuzzy Hash: 26800452dbc97e7387a556c4d9c675b6f0eaae040507a43ba61ad6f87429c469
                                                                                            • Instruction Fuzzy Hash: 5921B331801309EFDB109F25DD287AD7FA4BB80761F14835AF414A21B0E3719859CBB0
                                                                                            Function 00DC5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _memcmp
                                                                                            • String ID:
                                                                                            • API String ID: 2931989736-0
                                                                                            • Opcode ID: 2eea08010312a9bf8aa0c2f25bc1b8828a6c6c3e4d99f824f4005d8ec1ca3619
                                                                                            • Instruction ID: 1b96a1c87779b81224dd12411ce4004ba7012b7b7b1cf25e0961b7333bc118a1
                                                                                            • Opcode Fuzzy Hash: 2eea08010312a9bf8aa0c2f25bc1b8828a6c6c3e4d99f824f4005d8ec1ca3619
                                                                                            • Instruction Fuzzy Hash: 3E01B56664161ABFD2186610AE82FBB735CDF22394F144028FE049B2C5F760FDD983B4
                                                                                            Function 00D92DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetLastError.KERNEL32(?,?,?,00D8F2DE,00D93863,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6), ref: 00D92DFD
                                                                                            • _free.LIBCMT ref: 00D92E32
                                                                                            • _free.LIBCMT ref: 00D92E59
                                                                                            • SetLastError.KERNEL32(00000000,00D61129), ref: 00D92E66
                                                                                            • SetLastError.KERNEL32(00000000,00D61129), ref: 00D92E6F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$_free
                                                                                            • String ID:
                                                                                            • API String ID: 3170660625-0
                                                                                            • Opcode ID: c757ad025834f72891c3262765382f2d5a44330e4382a24013449a1ec72a84b5
                                                                                            • Instruction ID: 532a7952f01f1d90f53b83829f8d3c6a859eea722671bfe9a6ebfdc56d1380ee
                                                                                            • Opcode Fuzzy Hash: c757ad025834f72891c3262765382f2d5a44330e4382a24013449a1ec72a84b5
                                                                                            • Instruction Fuzzy Hash: D201A4326456007BCF1277757CCAD3B26ADEFD13B5B294029F465E2292EB64CC158170
                                                                                            Function 00DC000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?,?,00DC035E), ref: 00DC002B
                                                                                            • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?), ref: 00DC0046
                                                                                            • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?), ref: 00DC0054
                                                                                            • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?), ref: 00DC0064
                                                                                            • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DBFF41,80070057,?,?), ref: 00DC0070
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                            • String ID:
                                                                                            • API String ID: 3897988419-0
                                                                                            • Opcode ID: 5e063d743e50a3ea7a2e4ee9d2e97856a290bdb0df5f0dba1be2b09083d944f8
                                                                                            • Instruction ID: 04869802ebaab1330f88bd86a999fcca16ac0ad9528f2fecc159bd82da6db091
                                                                                            • Opcode Fuzzy Hash: 5e063d743e50a3ea7a2e4ee9d2e97856a290bdb0df5f0dba1be2b09083d944f8
                                                                                            • Instruction Fuzzy Hash: 55017872610209EBDB114F68DD04FAA7EADEB48792F159128F905D3210E771DE40ABB0
                                                                                            Function 00DCE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • QueryPerformanceCounter.KERNEL32(?), ref: 00DCE997
                                                                                            • QueryPerformanceFrequency.KERNEL32(?), ref: 00DCE9A5
                                                                                            • Sleep.KERNEL32(00000000), ref: 00DCE9AD
                                                                                            • QueryPerformanceCounter.KERNEL32(?), ref: 00DCE9B7
                                                                                            • Sleep.KERNEL32 ref: 00DCE9F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                            • String ID:
                                                                                            • API String ID: 2833360925-0
                                                                                            • Opcode ID: 32668360408f151da55d384762b8c46ce7fb23af2d84e8bf76a37bbece70214b
                                                                                            • Instruction ID: 65708ec0f09a8e1e2a90fe1e1e75dc5a8c72d5ad68e6ad8e2a10f37f83fe0702
                                                                                            • Opcode Fuzzy Hash: 32668360408f151da55d384762b8c46ce7fb23af2d84e8bf76a37bbece70214b
                                                                                            • Instruction Fuzzy Hash: C4010571D0162EDBCF00ABE5D959AEDBB78FF09701F00455AE542B2241CB309665CBB2
                                                                                            Function 00DC10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DC1114
                                                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1120
                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC112F
                                                                                            • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DC0B9B,?,?,?), ref: 00DC1136
                                                                                            • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DC114D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                            • String ID:
                                                                                            • API String ID: 842720411-0
                                                                                            • Opcode ID: 4241b178caed8ee150cf3a1281f2601ae77d22b96c890e57c5fac6a1a158d5de
                                                                                            • Instruction ID: ed2698519f8f4b27621fb93c90dc3e15af546a5de1a9664ac991fb0427e8700b
                                                                                            • Opcode Fuzzy Hash: 4241b178caed8ee150cf3a1281f2601ae77d22b96c890e57c5fac6a1a158d5de
                                                                                            • Instruction Fuzzy Hash: 1E016D79200319BFDB115FA4DD49E6A3B6EEF863A0B184418FA45C3360DB31DC20CA70
                                                                                            Function 00DC0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DC0FCA
                                                                                            • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DC0FD6
                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DC0FE5
                                                                                            • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DC0FEC
                                                                                            • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DC1002
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                            • String ID:
                                                                                            • API String ID: 44706859-0
                                                                                            • Opcode ID: 28a7fc367d00eb600a71ff7911349fee7fb956e47e524835f6d77c51de8ea0f1
                                                                                            • Instruction ID: 679e36f3801c816421967f156cb5a896a9c3318b865e799ebe52e8c4af712752
                                                                                            • Opcode Fuzzy Hash: 28a7fc367d00eb600a71ff7911349fee7fb956e47e524835f6d77c51de8ea0f1
                                                                                            • Instruction Fuzzy Hash: ADF0AF39200316ABD7210FA4AD4AF663BADEF8A761F108415F905C7351CA30DC60DA70
                                                                                            Function 00DC1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DC102A
                                                                                            • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1036
                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1045
                                                                                            • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC104C
                                                                                            • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1062
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                            • String ID:
                                                                                            • API String ID: 44706859-0
                                                                                            • Opcode ID: 6aa9b414939bdc936dda3c4c352c524778a2f2df39e7a3ab947d3390acd928cb
                                                                                            • Instruction ID: 2245cb44cd79ffb4d7470ea5b37d0afa91b7e0d9ccfb9463e6a0c2998928ddec
                                                                                            • Opcode Fuzzy Hash: 6aa9b414939bdc936dda3c4c352c524778a2f2df39e7a3ab947d3390acd928cb
                                                                                            • Instruction Fuzzy Hash: 66F0CD3920031AEBDB211FA4ED4AF663BADEF8A761F104418FE05C7351CA30D860DA70
                                                                                            Function 00DD030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD0324
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD0331
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD033E
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD034B
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD0358
                                                                                            • CloseHandle.KERNEL32(?,?,?,?,00DD017D,?,00DD32FC,?,00000001,00DA2592,?), ref: 00DD0365
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseHandle
                                                                                            • String ID:
                                                                                            • API String ID: 2962429428-0
                                                                                            • Opcode ID: c02b081c2913cbcdef8374254495dbb047014c3250846e5fe022b8e4856a1a52
                                                                                            • Instruction ID: c133e096378b24a7d71be50f9e2909e58d8d85dea87a7e47f85189f576689f57
                                                                                            • Opcode Fuzzy Hash: c02b081c2913cbcdef8374254495dbb047014c3250846e5fe022b8e4856a1a52
                                                                                            • Instruction Fuzzy Hash: C001A272800B559FC7309F66D880916FBF9BF903153198A3FD19652A31C3B1A954DF90
                                                                                            Function 00D9D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00D9D752
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • _free.LIBCMT ref: 00D9D764
                                                                                            • _free.LIBCMT ref: 00D9D776
                                                                                            • _free.LIBCMT ref: 00D9D788
                                                                                            • _free.LIBCMT ref: 00D9D79A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 4f66f4faedcaa493673fb82c681d0638bc32ead95863765c05adbd416ddafff0
                                                                                            • Instruction ID: 5bc68462ea1c363ee205c3203c73ef4d12cf2557b5974c2485ae7f6e194865fa
                                                                                            • Opcode Fuzzy Hash: 4f66f4faedcaa493673fb82c681d0638bc32ead95863765c05adbd416ddafff0
                                                                                            • Instruction Fuzzy Hash: 4EF0FF32544204BB8B25FBA5F9C5C2A77DEFB447107A80805F04DE7501C730FC818AB4
                                                                                            Function 00DC5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 00DC5C58
                                                                                            • GetWindowTextW.USER32(00000000,?,00000100), ref: 00DC5C6F
                                                                                            • MessageBeep.USER32(00000000), ref: 00DC5C87
                                                                                            • KillTimer.USER32(?,0000040A), ref: 00DC5CA3
                                                                                            • EndDialog.USER32(?,00000001), ref: 00DC5CBD
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3741023627-0
                                                                                            • Opcode ID: b40865eaaeb5f8b271547307c7236d693abb2a662782498dc4ad7eb7ecf22e3b
                                                                                            • Instruction ID: a9a357a000a0728059693dd1f813adbaed32cfe7d50a913b92093590b40c336b
                                                                                            • Opcode Fuzzy Hash: b40865eaaeb5f8b271547307c7236d693abb2a662782498dc4ad7eb7ecf22e3b
                                                                                            • Instruction Fuzzy Hash: B7018B30510705ABEB205B10EF4EFA577B8BF00B05F04555DA593E11E1DBF0B998CA70
                                                                                            Function 00D922A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _free.LIBCMT ref: 00D922BE
                                                                                              • Part of subcall function 00D929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000), ref: 00D929DE
                                                                                              • Part of subcall function 00D929C8: GetLastError.KERNEL32(00000000,?,00D9D7D1,00000000,00000000,00000000,00000000,?,00D9D7F8,00000000,00000007,00000000,?,00D9DBF5,00000000,00000000), ref: 00D929F0
                                                                                            • _free.LIBCMT ref: 00D922D0
                                                                                            • _free.LIBCMT ref: 00D922E3
                                                                                            • _free.LIBCMT ref: 00D922F4
                                                                                            • _free.LIBCMT ref: 00D92305
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$ErrorFreeHeapLast
                                                                                            • String ID:
                                                                                            • API String ID: 776569668-0
                                                                                            • Opcode ID: 0ff30c91d81b66afb2ce59f1d808022b1caec44e35d2929537fb3548e3f439ef
                                                                                            • Instruction ID: fac92cb21a7316c2fbd9054976a2a9762fdb28fab71f37150b4ce4a3b39f02ae
                                                                                            • Opcode Fuzzy Hash: 0ff30c91d81b66afb2ce59f1d808022b1caec44e35d2929537fb3548e3f439ef
                                                                                            • Instruction Fuzzy Hash: 0EF01770940524AF8B26FF56FC0982D3E64FB58760714054AF414F23B1C730191AAEF4
                                                                                            Function 00D795C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • EndPath.GDI32(?), ref: 00D795D4
                                                                                            • StrokeAndFillPath.GDI32(?,?,00DB71F7,00000000,?,?,?), ref: 00D795F0
                                                                                            • SelectObject.GDI32(?,00000000), ref: 00D79603
                                                                                            • DeleteObject.GDI32 ref: 00D79616
                                                                                            • StrokePath.GDI32(?), ref: 00D79631
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                            • String ID:
                                                                                            • API String ID: 2625713937-0
                                                                                            • Opcode ID: c51ed55535dc0dbb30bd39cb30dccea319fdc346f392e718dbfc06c41f7a248c
                                                                                            • Instruction ID: 66c423cfe5fcac58b9179b7bf113abc086f496f83b6fbb7698f9229367e775c9
                                                                                            • Opcode Fuzzy Hash: c51ed55535dc0dbb30bd39cb30dccea319fdc346f392e718dbfc06c41f7a248c
                                                                                            • Instruction Fuzzy Hash: 62F0E43500570CEFDB129F66EE2CB683F61AB81372F04C258A469A51F0DB3089A9DF30
                                                                                            Function 00D90F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: __freea$_free
                                                                                            • String ID: a/p$am/pm
                                                                                            • API String ID: 3432400110-3206640213
                                                                                            • Opcode ID: a970cd51b341444d5774fd1b41ebe170f9810aa89753ed603d37bd955b09d438
                                                                                            • Instruction ID: a78674a20098e00f3ec9433cce6adf99947c491a63b66bdc0f928372197b02a9
                                                                                            • Opcode Fuzzy Hash: a970cd51b341444d5774fd1b41ebe170f9810aa89753ed603d37bd955b09d438
                                                                                            • Instruction Fuzzy Hash: 37D1F139A00207DADF299F68C846BFEB7B1FF06300F284259E955AB650D3759D80CBB1
                                                                                            Function 00DE61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D80242: EnterCriticalSection.KERNEL32(00E3070C,00E31884,?,?,00D7198B,00E32518,?,?,?,00D612F9,00000000), ref: 00D8024D
                                                                                              • Part of subcall function 00D80242: LeaveCriticalSection.KERNEL32(00E3070C,?,00D7198B,00E32518,?,?,?,00D612F9,00000000), ref: 00D8028A
                                                                                              • Part of subcall function 00D800A3: __onexit.LIBCMT ref: 00D800A9
                                                                                            • __Init_thread_footer.LIBCMT ref: 00DE6238
                                                                                              • Part of subcall function 00D801F8: EnterCriticalSection.KERNEL32(00E3070C,?,?,00D78747,00E32514), ref: 00D80202
                                                                                              • Part of subcall function 00D801F8: LeaveCriticalSection.KERNEL32(00E3070C,?,00D78747,00E32514), ref: 00D80235
                                                                                              • Part of subcall function 00DD359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DD35E4
                                                                                              • Part of subcall function 00DD359C: LoadStringW.USER32(00E32390,?,00000FFF,?), ref: 00DD360A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
                                                                                            • String ID: x#$x#$x#
                                                                                            • API String ID: 1072379062-1894725482
                                                                                            • Opcode ID: 5109cc3d0a2c73093be730abc0430c0d1af1c6be7e5338824116d3578519a1af
                                                                                            • Instruction ID: 1376d49c27d89475a55655a2d34d0a5b8c7d89f070cd936f3f04dabb97ed0300
                                                                                            • Opcode Fuzzy Hash: 5109cc3d0a2c73093be730abc0430c0d1af1c6be7e5338824116d3578519a1af
                                                                                            • Instruction Fuzzy Hash: 59C19E71A00245AFCB14EF59C895EBEB7B9EF58340F148069FA45AB291DB70ED44CBB0
                                                                                            Function 00DE7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D80242: EnterCriticalSection.KERNEL32(00E3070C,00E31884,?,?,00D7198B,00E32518,?,?,?,00D612F9,00000000), ref: 00D8024D
                                                                                              • Part of subcall function 00D80242: LeaveCriticalSection.KERNEL32(00E3070C,?,00D7198B,00E32518,?,?,?,00D612F9,00000000), ref: 00D8028A
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00D800A3: __onexit.LIBCMT ref: 00D800A9
                                                                                            • __Init_thread_footer.LIBCMT ref: 00DE7BFB
                                                                                              • Part of subcall function 00D801F8: EnterCriticalSection.KERNEL32(00E3070C,?,?,00D78747,00E32514), ref: 00D80202
                                                                                              • Part of subcall function 00D801F8: LeaveCriticalSection.KERNEL32(00E3070C,?,00D78747,00E32514), ref: 00D80235
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                                            • String ID: 5$G$Variable must be of type 'Object'.
                                                                                            • API String ID: 535116098-3733170431
                                                                                            • Opcode ID: dd2dc354f81c36dd03b3d560222614bbeab54bd8741469a11c5130c847e9eeaf
                                                                                            • Instruction ID: 41b1fd96345f290fdce3d8286f141965f15cd1ce833a004527fe79499584c282
                                                                                            • Opcode Fuzzy Hash: dd2dc354f81c36dd03b3d560222614bbeab54bd8741469a11c5130c847e9eeaf
                                                                                            • Instruction Fuzzy Hash: 70918A74A04249EFCB04EF56D991DADBBB5FF48300F148049F846AB292DB71AE45CB71
                                                                                            Function 00DC2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DCB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DC21D0,?,?,00000034,00000800,?,00000034), ref: 00DCB42D
                                                                                            • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00DC2760
                                                                                              • Part of subcall function 00DCB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DC21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00DCB3F8
                                                                                              • Part of subcall function 00DCB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00DCB355
                                                                                              • Part of subcall function 00DCB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00DC2194,00000034,?,?,00001004,00000000,00000000), ref: 00DCB365
                                                                                              • Part of subcall function 00DCB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00DC2194,00000034,?,?,00001004,00000000,00000000), ref: 00DCB37B
                                                                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DC27CD
                                                                                            • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DC281A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                            • String ID: @
                                                                                            • API String ID: 4150878124-2766056989
                                                                                            • Opcode ID: 36185f3887b3d4c3d32432d5b550a34b4f013ac5d757bc39bbf79eecd8f45e3e
                                                                                            • Instruction ID: 19b6d400d59b77e0c62053dfcf39c558140d3b1a34cf6b223596645742538d0d
                                                                                            • Opcode Fuzzy Hash: 36185f3887b3d4c3d32432d5b550a34b4f013ac5d757bc39bbf79eecd8f45e3e
                                                                                            • Instruction Fuzzy Hash: 6A413A72900219AFDB10DBA4C982FEEBBB8EF09310F144059FA55B7181DA70AE45CBB1
                                                                                            Function 00D9172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00D91769
                                                                                            • _free.LIBCMT ref: 00D91834
                                                                                            • _free.LIBCMT ref: 00D9183E
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free$FileModuleName
                                                                                            • String ID: C:\Users\user\Desktop\file.exe
                                                                                            • API String ID: 2506810119-1957095476
                                                                                            • Opcode ID: 138ad83e500c9d29bf85254f8d2c05b8fd22f6886cd5cb58667eb7bc971ae4cd
                                                                                            • Instruction ID: 1094b7bbaca4c569670c6499978fe1a1a3fc2fd7b463678befceb8bcac8ff8dc
                                                                                            • Opcode Fuzzy Hash: 138ad83e500c9d29bf85254f8d2c05b8fd22f6886cd5cb58667eb7bc971ae4cd
                                                                                            • Instruction Fuzzy Hash: 45318179A0025AFFDF21DB999885D9EBBBCEF85310B1441AAF804D7211D6708E44DBB0
                                                                                            Function 00DCC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00DCC306
                                                                                            • DeleteMenu.USER32(?,00000007,00000000), ref: 00DCC34C
                                                                                            • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E31990,00F85670), ref: 00DCC395
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$Delete$InfoItem
                                                                                            • String ID: 0
                                                                                            • API String ID: 135850232-4108050209
                                                                                            • Opcode ID: af8af6d1580a81f6a3902677e40946f3fa9f596d6082e9ef2e5bde02991200f1
                                                                                            • Instruction ID: 684691e7c691d0e81cb183bddb932c2754bda66fe27f70087ac1e40f6cfe6301
                                                                                            • Opcode Fuzzy Hash: af8af6d1580a81f6a3902677e40946f3fa9f596d6082e9ef2e5bde02991200f1
                                                                                            • Instruction Fuzzy Hash: 614191712143429FDB20DF24E845F2ABBE4EB85320F04961EFAA9D7291D730E904CB72
                                                                                            Function 00DF4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00DFCC08,00000000,?,?,?,?), ref: 00DF44AA
                                                                                            • GetWindowLongW.USER32 ref: 00DF44C7
                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DF44D7
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long
                                                                                            • String ID: SysTreeView32
                                                                                            • API String ID: 847901565-1698111956
                                                                                            • Opcode ID: b7a5f97330dc5064a4c796d3eade0d7c6afe164673d1eff651dd6c0819479160
                                                                                            • Instruction ID: 95787a398b87dc6350054eda0b185815adb1382ffb46aca5aa2d0f914ddd7c3c
                                                                                            • Opcode Fuzzy Hash: b7a5f97330dc5064a4c796d3eade0d7c6afe164673d1eff651dd6c0819479160
                                                                                            • Instruction Fuzzy Hash: 08316D31214209AFDB209E38DC45BEB77A9EB08324F258715FA79E22E0D770EC549B60
                                                                                            Function 00DE304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DE335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00DE3077,?,?), ref: 00DE3378
                                                                                            • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DE307A
                                                                                            • _wcslen.LIBCMT ref: 00DE309B
                                                                                            • htons.WSOCK32(00000000,?,?,00000000), ref: 00DE3106
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                                            • String ID: 255.255.255.255
                                                                                            • API String ID: 946324512-2422070025
                                                                                            • Opcode ID: b11f378ed5637471eecf07c82e0049ea48851f812c8fe2cdcb7d279d1ef2e562
                                                                                            • Instruction ID: 7dced212dd560af03780c9940fef17f0f8175842a80366227f42db2258e3361c
                                                                                            • Opcode Fuzzy Hash: b11f378ed5637471eecf07c82e0049ea48851f812c8fe2cdcb7d279d1ef2e562
                                                                                            • Instruction Fuzzy Hash: EE31D3352043859FCB20EF6AC589EBA77E0EF54318F298059E8158B392DB32EE45C770
                                                                                            Function 00DF3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00DF3F40
                                                                                            • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00DF3F54
                                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00DF3F78
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$Window
                                                                                            • String ID: SysMonthCal32
                                                                                            • API String ID: 2326795674-1439706946
                                                                                            • Opcode ID: d6bdb491306e588695fcd8b161bc27ee7f90d2272f2f1d9892cf275eba10685d
                                                                                            • Instruction ID: 094734f6e28e61fa664ffe72dacbd3219ec85f2b8e1c0c398489f384bb90c941
                                                                                            • Opcode Fuzzy Hash: d6bdb491306e588695fcd8b161bc27ee7f90d2272f2f1d9892cf275eba10685d
                                                                                            • Instruction Fuzzy Hash: DF21AB32610219BBDF258F50CC46FEA3B79EF48724F164218FE15AB190D6B1A890CBA0
                                                                                            Function 00DF4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00DF4705
                                                                                            • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00DF4713
                                                                                            • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00DF471A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$DestroyWindow
                                                                                            • String ID: msctls_updown32
                                                                                            • API String ID: 4014797782-2298589950
                                                                                            • Opcode ID: c9c497b602c32a2c370d418cc9c65eabe07ec2bd69924c2fffc1a6fb243bdc99
                                                                                            • Instruction ID: baa6de85721da91c632d7597f912272d2c733fd20df0dc903ae444c32291b763
                                                                                            • Opcode Fuzzy Hash: c9c497b602c32a2c370d418cc9c65eabe07ec2bd69924c2fffc1a6fb243bdc99
                                                                                            • Instruction Fuzzy Hash: 65212FB5604209AFDB10DF69DC85DB737ADEB9A368B054059FA00DB251C771EC11CA70
                                                                                            Function 00DC95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                            • API String ID: 176396367-2734436370
                                                                                            • Opcode ID: 4b57e749bec88adfde27718c92290f66b56514d8465885834ef09a0c6712e1d1
                                                                                            • Instruction ID: e2d88a32ec2c49bbded5cd840e171f8eed7eefc9b5cd2618be3cab470615ac6b
                                                                                            • Opcode Fuzzy Hash: 4b57e749bec88adfde27718c92290f66b56514d8465885834ef09a0c6712e1d1
                                                                                            • Instruction Fuzzy Hash: 4221383225415266D331BB24DC2AFB7F398EF55314F58402EF98997081EB61DD45C3B5
                                                                                            Function 00DF37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00DF3840
                                                                                            • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00DF3850
                                                                                            • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00DF3876
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend$MoveWindow
                                                                                            • String ID: Listbox
                                                                                            • API String ID: 3315199576-2633736733
                                                                                            • Opcode ID: 5993e7a390777fd629cea0d185bf25aab1efe9b1058d1132d98ebd08c4b98788
                                                                                            • Instruction ID: 7bcd31705e46a6002d0a582768f9e9a94088100045a512d985e64e850d40d7f4
                                                                                            • Opcode Fuzzy Hash: 5993e7a390777fd629cea0d185bf25aab1efe9b1058d1132d98ebd08c4b98788
                                                                                            • Instruction Fuzzy Hash: 2121BE7261021CBBEB219F64DC85EBB376AEF897A0F16C124FA009B190C675DC52C7B0
                                                                                            Function 00DD49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 00DD4A08
                                                                                            • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00DD4A5C
                                                                                            • SetErrorMode.KERNEL32(00000000,?,?,00DFCC08), ref: 00DD4AD0
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorMode$InformationVolume
                                                                                            • String ID: %lu
                                                                                            • API String ID: 2507767853-685833217
                                                                                            • Opcode ID: 8ff0f23a8a4c4374d431e0f7b996c7e6968b3be0ce9dd32c121c92166fc27506
                                                                                            • Instruction ID: 865fd3afd742ed6ec2dd582b51c4b4514a18c4819de38d27b6744b73fc8868f3
                                                                                            • Opcode Fuzzy Hash: 8ff0f23a8a4c4374d431e0f7b996c7e6968b3be0ce9dd32c121c92166fc27506
                                                                                            • Instruction Fuzzy Hash: 92313E75A00209AFDB10DF54C985EAABBF8EF08318F1480A9E909DB352D771EE55CB71
                                                                                            Function 00DF41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00DF424F
                                                                                            • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00DF4264
                                                                                            • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00DF4271
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: msctls_trackbar32
                                                                                            • API String ID: 3850602802-1010561917
                                                                                            • Opcode ID: 40727b3b86769840bb02abb8f0294528e1e95dafe75e416519ddcb412f5566df
                                                                                            • Instruction ID: dbf916b5c9239c9d8af47abf93a29a502b01d08dc93783ce8a6696c1168b162b
                                                                                            • Opcode Fuzzy Hash: 40727b3b86769840bb02abb8f0294528e1e95dafe75e416519ddcb412f5566df
                                                                                            • Instruction Fuzzy Hash: F211E33124024CBEEF205E29CC06FBB3BACEF85B64F028528FA55E21A0D271D811DB34
                                                                                            Function 00DC2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                              • Part of subcall function 00DC2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DC2DC5
                                                                                              • Part of subcall function 00DC2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DC2DD6
                                                                                              • Part of subcall function 00DC2DA7: GetCurrentThreadId.KERNEL32 ref: 00DC2DDD
                                                                                              • Part of subcall function 00DC2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DC2DE4
                                                                                            • GetFocus.USER32 ref: 00DC2F78
                                                                                              • Part of subcall function 00DC2DEE: GetParent.USER32(00000000), ref: 00DC2DF9
                                                                                            • GetClassNameW.USER32(?,?,00000100), ref: 00DC2FC3
                                                                                            • EnumChildWindows.USER32(?,00DC303B), ref: 00DC2FEB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                                            • String ID: %s%d
                                                                                            • API String ID: 1272988791-1110647743
                                                                                            • Opcode ID: fb483f50fae462df5af976997fe1389d959d67b6d47f89dc102a951e0cf53bd5
                                                                                            • Instruction ID: 42c3c7a9e975f8e7354df215f7f99e5ad6def64bb14c196fa2bc763959bcd80e
                                                                                            • Opcode Fuzzy Hash: fb483f50fae462df5af976997fe1389d959d67b6d47f89dc102a951e0cf53bd5
                                                                                            • Instruction Fuzzy Hash: 1311907160020AABCF556F649C86FFD376AEF94304F04D079B909DB292EE7099499B70
                                                                                            Function 00DF5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00DF58C1
                                                                                            • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00DF58EE
                                                                                            • DrawMenuBar.USER32(?), ref: 00DF58FD
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Menu$InfoItem$Draw
                                                                                            • String ID: 0
                                                                                            • API String ID: 3227129158-4108050209
                                                                                            • Opcode ID: b7d1b1cb87379460f6e63f84e8b87d5b9953a88aade361cb4bed38176ff35d27
                                                                                            • Instruction ID: 830c285e9c58e4f5e412c8f7a8c05f28bb1491f05f999dc30e8701836464cf36
                                                                                            • Opcode Fuzzy Hash: b7d1b1cb87379460f6e63f84e8b87d5b9953a88aade361cb4bed38176ff35d27
                                                                                            • Instruction Fuzzy Hash: C101393150021CEEDB219F21E844BAABBB4FF45360F14C099EA89D6251EB708A94EF31
                                                                                            Function 00DC007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 67fca20320824de370525af99c2a197d4b007aaac95a03d1d43fe91c0e79aaf7
                                                                                            • Instruction ID: 21749e78827cef215ac348bf2ac9670513b4a1dfae0193a3ff9352608fb64482
                                                                                            • Opcode Fuzzy Hash: 67fca20320824de370525af99c2a197d4b007aaac95a03d1d43fe91c0e79aaf7
                                                                                            • Instruction Fuzzy Hash: 2CC10975A0021AEFDB14CF98C894FAABBB5FF48704F258598E505EB251D731EE41CBA0
                                                                                            Function 00D93E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: __alldvrm$_strrchr
                                                                                            • String ID:
                                                                                            • API String ID: 1036877536-0
                                                                                            • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                            • Instruction ID: 992a2ac133044f1ec965affb92c31d54f8ef35b1db87da2810cab520df893eea
                                                                                            • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                                            • Instruction Fuzzy Hash: 3CA14A76E007869FDF25CF18C891BAEBBE5EF65350F18426DE5959B282C2348D82C770
                                                                                            Function 00DE342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Variant$ClearInitInitializeUninitialize
                                                                                            • String ID:
                                                                                            • API String ID: 1998397398-0
                                                                                            • Opcode ID: 22061d5ba83d185bc0dc3312c5dbec34b104a01d935f5570f95fb50e94a1cd06
                                                                                            • Instruction ID: f56c7121adb3d0ed36d76a15325cce858bb35c35176d73ace7105127257a5daf
                                                                                            • Opcode Fuzzy Hash: 22061d5ba83d185bc0dc3312c5dbec34b104a01d935f5570f95fb50e94a1cd06
                                                                                            • Instruction Fuzzy Hash: EBA106756146449FC710EF29C585A2AB7E5FF88714F048859F98A9B362DB30EE01CBB1
                                                                                            Function 00DC0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00DFFC08,?), ref: 00DC05F0
                                                                                            • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00DFFC08,?), ref: 00DC0608
                                                                                            • CLSIDFromProgID.OLE32(?,?,00000000,00DFCC40,000000FF,?,00000000,00000800,00000000,?,00DFFC08,?), ref: 00DC062D
                                                                                            • _memcmp.LIBVCRUNTIME ref: 00DC064E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FromProg$FreeTask_memcmp
                                                                                            • String ID:
                                                                                            • API String ID: 314563124-0
                                                                                            • Opcode ID: a08dcdadebf384f81d067902f8abb34ce9bf3ffdab66c81ca8409576bfeea197
                                                                                            • Instruction ID: 2c149a66a26d01c2999856348fbf2df86e5abaa14ce1e4756613d8c2226d6c0e
                                                                                            • Opcode Fuzzy Hash: a08dcdadebf384f81d067902f8abb34ce9bf3ffdab66c81ca8409576bfeea197
                                                                                            • Instruction Fuzzy Hash: DC81FA75A1010AEFCB04DF94C984EEEBBB9FF89315F244558E506AB250DB71AE06CF60
                                                                                            Function 00DEA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateToolhelp32Snapshot.KERNEL32 ref: 00DEA6AC
                                                                                            • Process32FirstW.KERNEL32(00000000,?), ref: 00DEA6BA
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • Process32NextW.KERNEL32(00000000,?), ref: 00DEA79C
                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00DEA7AB
                                                                                              • Part of subcall function 00D7CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00DA3303,?), ref: 00D7CE8A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 1991900642-0
                                                                                            • Opcode ID: 9e81cb81ed47d26997ff2f329150fc875b0deef15b1c34f52b4d866387a779a1
                                                                                            • Instruction ID: 7ac961499808ecba414d824e783947abd9e49080f472439f612eaa7dd7028a05
                                                                                            • Opcode Fuzzy Hash: 9e81cb81ed47d26997ff2f329150fc875b0deef15b1c34f52b4d866387a779a1
                                                                                            • Instruction Fuzzy Hash: 94513A71508341AFD710EF25C886A6BBBE8FF89754F04891DF58997291EB30E904CBB2
                                                                                            Function 00DA1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _free
                                                                                            • String ID:
                                                                                            • API String ID: 269201875-0
                                                                                            • Opcode ID: 3b62e4241c0e04aafdf66be6f73aa6de03eb7dafefc489bcca78fb59bc1e0c13
                                                                                            • Instruction ID: 219623e6b9a09af6bc3c2b06195130d825a3e1afd7980098d579899fa9146794
                                                                                            • Opcode Fuzzy Hash: 3b62e4241c0e04aafdf66be6f73aa6de03eb7dafefc489bcca78fb59bc1e0c13
                                                                                            • Instruction Fuzzy Hash: 8B414C39A00214ABDF217BFD9C45BBE3AA5EF4B370F184225F418D62D2E7B4884193B1
                                                                                            Function 00DF6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DF62E2
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF6315
                                                                                            • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00DF6382
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ClientMoveRectScreen
                                                                                            • String ID:
                                                                                            • API String ID: 3880355969-0
                                                                                            • Opcode ID: 997c973d842ebffc20d246d57668c73c511b18bad8ce7fe00d215d698e20895d
                                                                                            • Instruction ID: c978dc49555f199826b7a2b72ece21681b3a5475641411ec42ec56df77a6864b
                                                                                            • Opcode Fuzzy Hash: 997c973d842ebffc20d246d57668c73c511b18bad8ce7fe00d215d698e20895d
                                                                                            • Instruction Fuzzy Hash: 5A513A74A00209EFCB14DF68D980ABE7BF5EF95360F198169F9159B6A0D730ED81CB60
                                                                                            Function 00DE1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • socket.WSOCK32(00000002,00000002,00000011), ref: 00DE1AFD
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1B0B
                                                                                            • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00DE1B8A
                                                                                            • WSAGetLastError.WSOCK32 ref: 00DE1B94
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorLast$socket
                                                                                            • String ID:
                                                                                            • API String ID: 1881357543-0
                                                                                            • Opcode ID: 5f7256374a3bdb932361616586609d13cb7038b0df8c00d63dcde3b0cd6b8062
                                                                                            • Instruction ID: 9d7a8aa44da8988491d6de9b86498a088791ed5e756a8bafd316955855118502
                                                                                            • Opcode Fuzzy Hash: 5f7256374a3bdb932361616586609d13cb7038b0df8c00d63dcde3b0cd6b8062
                                                                                            • Instruction Fuzzy Hash: 32418278600200AFD720AF25C886F2677E5EB45718F58C458F95A9F3D2D672ED41CBB0
                                                                                            Function 00D9B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2ba31d11361ecda9c28c97a6e87f65d8af728d3e4934befd196e7dd0ec3bf878
                                                                                            • Instruction ID: 3dc666192ffcfcb6bff9a4a5ca30c6810a32cf7f75fb141df66a73542f1f6424
                                                                                            • Opcode Fuzzy Hash: 2ba31d11361ecda9c28c97a6e87f65d8af728d3e4934befd196e7dd0ec3bf878
                                                                                            • Instruction Fuzzy Hash: 27412675A00304BFDB24AF78DD41BAABBE9EB88724F11452BF141DB292D371990187B0
                                                                                            Function 00DD56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DD5783
                                                                                            • GetLastError.KERNEL32(?,00000000), ref: 00DD57A9
                                                                                            • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00DD57CE
                                                                                            • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00DD57FA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                            • String ID:
                                                                                            • API String ID: 3321077145-0
                                                                                            • Opcode ID: 463d667848b49b2ac5a377b75c2bbedd9624959cf36e08604044d885c8d485f6
                                                                                            • Instruction ID: 85734535230732632985f87ddf8f1bcdb3273a7631a95aeb41948e1094688bf5
                                                                                            • Opcode Fuzzy Hash: 463d667848b49b2ac5a377b75c2bbedd9624959cf36e08604044d885c8d485f6
                                                                                            • Instruction Fuzzy Hash: B9412939610614DFCB11EF15C544A5EBBE2EF89324B19C489E84AAB362CB30FD50CBB1
                                                                                            Function 00D9D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00D86D71,00000000,00000000,00D882D9,?,00D882D9,?,00000001,00D86D71,8BE85006,00000001,00D882D9,00D882D9), ref: 00D9D910
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D9D999
                                                                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00D9D9AB
                                                                                            • __freea.LIBCMT ref: 00D9D9B4
                                                                                              • Part of subcall function 00D93820: RtlAllocateHeap.NTDLL(00000000,?,00E31444,?,00D7FDF5,?,?,00D6A976,00000010,00E31440,00D613FC,?,00D613C6,?,00D61129), ref: 00D93852
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                            • String ID:
                                                                                            • API String ID: 2652629310-0
                                                                                            • Opcode ID: cd65c6cfd6a132616a4854269006814eca4bed78dfc517d6f11ae7f7296efaad
                                                                                            • Instruction ID: 5820bf6dee32c85591150fcedb05a9df070cea4396355aa52bcc0c2e5705d4f0
                                                                                            • Opcode Fuzzy Hash: cd65c6cfd6a132616a4854269006814eca4bed78dfc517d6f11ae7f7296efaad
                                                                                            • Instruction Fuzzy Hash: 3E31B072A0020AABDF24EFA5DC41EAE7BA6EB40310B194169FC04D7250EB35CD64CBB0
                                                                                            Function 00DF52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00DF5352
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF5375
                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DF5382
                                                                                            • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00DF53A8
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LongWindow$InvalidateMessageRectSend
                                                                                            • String ID:
                                                                                            • API String ID: 3340791633-0
                                                                                            • Opcode ID: cd25751979ddf15d2151c235ad9c118ed9a8a7a4188b79c12367e5f462c870b6
                                                                                            • Instruction ID: f29afc944fb6984ccd50e693e6735443641df89c0b69862f59905083db0a4851
                                                                                            • Opcode Fuzzy Hash: cd25751979ddf15d2151c235ad9c118ed9a8a7a4188b79c12367e5f462c870b6
                                                                                            • Instruction Fuzzy Hash: 6A31C134A55A0CEFEB209A1CEC05BF877E1AB04390F5EC001FB51962E5C7B1A940DB72
                                                                                            Function 00DCAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00DCABF1
                                                                                            • SetKeyboardState.USER32(00000080,?,00008000), ref: 00DCAC0D
                                                                                            • PostMessageW.USER32(00000000,00000101,00000000), ref: 00DCAC74
                                                                                            • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00DCACC6
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: KeyboardState$InputMessagePostSend
                                                                                            • String ID:
                                                                                            • API String ID: 432972143-0
                                                                                            • Opcode ID: 305d270e507da66e3734e149fb622bba33a016709426b7954974888fe5a7b988
                                                                                            • Instruction ID: 45d17451702203853dd2f3a9fccc1db4d7d982582baf3575b6d9316d97d2401c
                                                                                            • Opcode Fuzzy Hash: 305d270e507da66e3734e149fb622bba33a016709426b7954974888fe5a7b988
                                                                                            • Instruction Fuzzy Hash: 37311634A4431E6FEF258B6C8908FFA7AA5AB85318F08431EE491932D1C37489958776
                                                                                            Function 00DF7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ClientToScreen.USER32(?,?), ref: 00DF769A
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DF7710
                                                                                            • PtInRect.USER32(?,?,00DF8B89), ref: 00DF7720
                                                                                            • MessageBeep.USER32(00000000), ref: 00DF778C
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Rect$BeepClientMessageScreenWindow
                                                                                            • String ID:
                                                                                            • API String ID: 1352109105-0
                                                                                            • Opcode ID: d5328cf3cf8718154b9d6dfd3de040113bf023ac1628e7489b2c9be33c664b5f
                                                                                            • Instruction ID: c0690dfdc8678df039a680a9311f4f7336960e41c6866f1b81b8d66281ed67b3
                                                                                            • Opcode Fuzzy Hash: d5328cf3cf8718154b9d6dfd3de040113bf023ac1628e7489b2c9be33c664b5f
                                                                                            • Instruction Fuzzy Hash: 4C415A3461521CDFCB01EF59C894EF97BB5BB49314F1AC0A8E6149B261C730A946CBA0
                                                                                            Function 00DF16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetForegroundWindow.USER32 ref: 00DF16EB
                                                                                              • Part of subcall function 00DC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DC3A57
                                                                                              • Part of subcall function 00DC3A3D: GetCurrentThreadId.KERNEL32 ref: 00DC3A5E
                                                                                              • Part of subcall function 00DC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DC25B3), ref: 00DC3A65
                                                                                            • GetCaretPos.USER32(?), ref: 00DF16FF
                                                                                            • ClientToScreen.USER32(00000000,?), ref: 00DF174C
                                                                                            • GetForegroundWindow.USER32 ref: 00DF1752
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                            • String ID:
                                                                                            • API String ID: 2759813231-0
                                                                                            • Opcode ID: c17e4d0aaf8f9f2e02db12b775ffa3809d91c6cb105bbfcc8617be8e4b62a5ad
                                                                                            • Instruction ID: 9bdfb497163e411598d24d1af370ce129f313069218412f3932bac582c616f05
                                                                                            • Opcode Fuzzy Hash: c17e4d0aaf8f9f2e02db12b775ffa3809d91c6cb105bbfcc8617be8e4b62a5ad
                                                                                            • Instruction Fuzzy Hash: 82313D75D10249EFC704EFA9C981DAEBBF9EF88304B5480AAE455E7211E631DE45CBB0
                                                                                            Function 00DCDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D67620: _wcslen.LIBCMT ref: 00D67625
                                                                                            • _wcslen.LIBCMT ref: 00DCDFCB
                                                                                            • _wcslen.LIBCMT ref: 00DCDFE2
                                                                                            • _wcslen.LIBCMT ref: 00DCE00D
                                                                                            • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00DCE018
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$ExtentPoint32Text
                                                                                            • String ID:
                                                                                            • API String ID: 3763101759-0
                                                                                            • Opcode ID: 56ca2b766ab9aef7e617cea80e1fbda6a067d30d598098f5721719a61a0c4aad
                                                                                            • Instruction ID: 4ab794e185dcee77fb9aaf82c9d496798841ca03b461fc773d99798ad8b675e9
                                                                                            • Opcode Fuzzy Hash: 56ca2b766ab9aef7e617cea80e1fbda6a067d30d598098f5721719a61a0c4aad
                                                                                            • Instruction Fuzzy Hash: 37219571900219AFCB21EFA8D982F6EB7F8EF45760F144069E805BB285D6709E41CBF1
                                                                                            Function 00DF8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • GetCursorPos.USER32(?), ref: 00DF9001
                                                                                            • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DB7711,?,?,?,?,?), ref: 00DF9016
                                                                                            • GetCursorPos.USER32(?), ref: 00DF905E
                                                                                            • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DB7711,?,?,?), ref: 00DF9094
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2864067406-0
                                                                                            • Opcode ID: 0a029730879f406584d1f60b340e683dae7adcc8dc40b07c87ec9dccd46a1765
                                                                                            • Instruction ID: 1995f4f261281efa206c3089532fcb72428cd1c992d252ec4a4fdcdeeb775455
                                                                                            • Opcode Fuzzy Hash: 0a029730879f406584d1f60b340e683dae7adcc8dc40b07c87ec9dccd46a1765
                                                                                            • Instruction Fuzzy Hash: 59217E35A0011CEFDB158FA5C868FFABBB9EB89350F058069F6059B2A1C7319990DF70
                                                                                            Function 00DCD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetFileAttributesW.KERNEL32(?,00DFCB68), ref: 00DCD2FB
                                                                                            • GetLastError.KERNEL32 ref: 00DCD30A
                                                                                            • CreateDirectoryW.KERNEL32(?,00000000), ref: 00DCD319
                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00DFCB68), ref: 00DCD376
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateDirectory$AttributesErrorFileLast
                                                                                            • String ID:
                                                                                            • API String ID: 2267087916-0
                                                                                            • Opcode ID: 8769c89d6df5a7d5eca4d4472cf93a63f39ad7198ad950264f3e94c824e4e0e4
                                                                                            • Instruction ID: 1c73a97c2832f4ef2cca73ca330ce69e58e390c0cb41b3d410fb73c6f953ccb6
                                                                                            • Opcode Fuzzy Hash: 8769c89d6df5a7d5eca4d4472cf93a63f39ad7198ad950264f3e94c824e4e0e4
                                                                                            • Instruction Fuzzy Hash: E221B2705083069F8700DF28CD819AEB7E8EE56364F544A2EF499C72A1D730D94ACBB3
                                                                                            Function 00DC1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DC102A
                                                                                              • Part of subcall function 00DC1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1036
                                                                                              • Part of subcall function 00DC1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1045
                                                                                              • Part of subcall function 00DC1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC104C
                                                                                              • Part of subcall function 00DC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DC1062
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00DC15BE
                                                                                            • _memcmp.LIBVCRUNTIME ref: 00DC15E1
                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DC1617
                                                                                            • HeapFree.KERNEL32(00000000), ref: 00DC161E
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                                            • String ID:
                                                                                            • API String ID: 1592001646-0
                                                                                            • Opcode ID: 9f6d5e0d4923f4d8570c2c77fa44ef643469be9478faeadc8172551cf8f1042a
                                                                                            • Instruction ID: f305488af11a2e918d24678e2ac5663339c1db97e3aa13e5a6dba14f556501c4
                                                                                            • Opcode Fuzzy Hash: 9f6d5e0d4923f4d8570c2c77fa44ef643469be9478faeadc8172551cf8f1042a
                                                                                            • Instruction Fuzzy Hash: 91217A75E5021AAFDB10DFA4C945FEEB7B8EF46344F188459E441AB242E730AA05DBA0
                                                                                            Function 00DF2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowLongW.USER32(?,000000EC), ref: 00DF280A
                                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DF2824
                                                                                            • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DF2832
                                                                                            • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00DF2840
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long$AttributesLayered
                                                                                            • String ID:
                                                                                            • API String ID: 2169480361-0
                                                                                            • Opcode ID: bbe77bbacde816a7dfb25b5f490480366c29fdf61a0c7d74a6f91fd7787a1968
                                                                                            • Instruction ID: d188ff8eb36587308d4ddcd8c7bd77fc0c065821f54fc98508d2e448a353649b
                                                                                            • Opcode Fuzzy Hash: bbe77bbacde816a7dfb25b5f490480366c29fdf61a0c7d74a6f91fd7787a1968
                                                                                            • Instruction Fuzzy Hash: 8021AE31205619AFD7149B24C844FBA7BA5EF85324F19C158E526CB6E2C771ED82C7B0
                                                                                            Function 00DC78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00DC8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00DC790A,?,000000FF,?,00DC8754,00000000,?,0000001C,?,?), ref: 00DC8D8C
                                                                                              • Part of subcall function 00DC8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00DC8DB2
                                                                                              • Part of subcall function 00DC8D7D: lstrcmpiW.KERNEL32(00000000,?,00DC790A,?,000000FF,?,00DC8754,00000000,?,0000001C,?,?), ref: 00DC8DE3
                                                                                            • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00DC8754,00000000,?,0000001C,?,?,00000000), ref: 00DC7923
                                                                                            • lstrcpyW.KERNEL32(00000000,?), ref: 00DC7949
                                                                                            • lstrcmpiW.KERNEL32(00000002,cdecl,?,00DC8754,00000000,?,0000001C,?,?,00000000), ref: 00DC7984
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: lstrcmpilstrcpylstrlen
                                                                                            • String ID: cdecl
                                                                                            • API String ID: 4031866154-3896280584
                                                                                            • Opcode ID: c2177926b794ef22c62e1e23327911e7c91a57493f3270f3bf5829c9beba1050
                                                                                            • Instruction ID: 24307c77397ae720f16bb93390de935874df08a30ada2461447666f30d32347b
                                                                                            • Opcode Fuzzy Hash: c2177926b794ef22c62e1e23327911e7c91a57493f3270f3bf5829c9beba1050
                                                                                            • Instruction Fuzzy Hash: 7111B43A200306ABCB255F34D845E7A77A5FF45350B50802EF946C7264EF319811DF71
                                                                                            Function 00DF7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00DF7D0B
                                                                                            • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00DF7D2A
                                                                                            • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00DF7D42
                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00DDB7AD,00000000), ref: 00DF7D6B
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$Long
                                                                                            • String ID:
                                                                                            • API String ID: 847901565-0
                                                                                            • Opcode ID: 428a40359f5240bad6c938e845d9151ba08879acb10a68a0697d16e65f268a30
                                                                                            • Instruction ID: 1f63a182168f5994b08ca7f0be76732fb0b7152c71d7e87cfa23931ce3760437
                                                                                            • Opcode Fuzzy Hash: 428a40359f5240bad6c938e845d9151ba08879acb10a68a0697d16e65f268a30
                                                                                            • Instruction Fuzzy Hash: 3B1193315146199FCB109F29DC04AB63BA5AF45360F5AC728F939D72F0D7309962CB60
                                                                                            Function 00DF5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,00001060,?,00000004), ref: 00DF56BB
                                                                                            • _wcslen.LIBCMT ref: 00DF56CD
                                                                                            • _wcslen.LIBCMT ref: 00DF56D8
                                                                                            • SendMessageW.USER32(?,00001002,00000000,?), ref: 00DF5816
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend_wcslen
                                                                                            • String ID:
                                                                                            • API String ID: 455545452-0
                                                                                            • Opcode ID: 3fa3717e5f6c33f414cd42a239774d8577a300ff7cd596c8fbfa74832ff2f734
                                                                                            • Instruction ID: 54dc5aad45be30ee476428db37ef3d0d6633e59bdf2f43a351108801b2cbc951
                                                                                            • Opcode Fuzzy Hash: 3fa3717e5f6c33f414cd42a239774d8577a300ff7cd596c8fbfa74832ff2f734
                                                                                            • Instruction Fuzzy Hash: 2311B17560060DA6DB20AF61EC85AFE77ACEF11764B14C02AFB55D6085EBB0CA84CF70
                                                                                            Function 00D91D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 98a8af415b00c5f02362ed0b672d579b3dfd6c97f3a2fcfa97f6ba2eee246968
                                                                                            • Instruction ID: 572653ffd33261d28f7375d4954ec48ea46ecefbb503bebfbdaa3377a7f2457b
                                                                                            • Opcode Fuzzy Hash: 98a8af415b00c5f02362ed0b672d579b3dfd6c97f3a2fcfa97f6ba2eee246968
                                                                                            • Instruction Fuzzy Hash: 91018BB620961B3EFF2126786CC0F37661DDF813B8B380325F521A22D2DB608C118170
                                                                                            Function 00DC1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(?,000000B0,?,?), ref: 00DC1A47
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DC1A59
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DC1A6F
                                                                                            • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DC1A8A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID:
                                                                                            • API String ID: 3850602802-0
                                                                                            • Opcode ID: 774224cddebcaa973700951b1fc264702f91422cd9e424e6872da9c905745abc
                                                                                            • Instruction ID: bab6543aaff72179cd814d67c69a46314de4e626e9153d4e1792fafc1173fd6b
                                                                                            • Opcode Fuzzy Hash: 774224cddebcaa973700951b1fc264702f91422cd9e424e6872da9c905745abc
                                                                                            • Instruction Fuzzy Hash: EF113C3AD01229FFEB10DBA4CD85FADBB78EB04750F200095E600F7290D6716E51DBA4
                                                                                            Function 00DCE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00DCE1FD
                                                                                            • MessageBoxW.USER32(?,?,?,?), ref: 00DCE230
                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00DCE246
                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00DCE24D
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                            • String ID:
                                                                                            • API String ID: 2880819207-0
                                                                                            • Opcode ID: 8378c177f9b41a9432df50baef045249422934ce9b2843d1e83456a95c802ea9
                                                                                            • Instruction ID: f024466d699a8a2a2707e29b148601bd2e334cc2c0d90074045b517d8e7ee8c2
                                                                                            • Opcode Fuzzy Hash: 8378c177f9b41a9432df50baef045249422934ce9b2843d1e83456a95c802ea9
                                                                                            • Instruction Fuzzy Hash: 2A11A1B6904359AFC7019BA99C09FAE7FADAB45324F058259F924E3291D6B0891487B0
                                                                                            Function 00D8D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateThread.KERNEL32(00000000,?,00D8CFF9,00000000,00000004,00000000), ref: 00D8D218
                                                                                            • GetLastError.KERNEL32 ref: 00D8D224
                                                                                            • __dosmaperr.LIBCMT ref: 00D8D22B
                                                                                            • ResumeThread.KERNEL32(00000000), ref: 00D8D249
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                                            • String ID:
                                                                                            • API String ID: 173952441-0
                                                                                            • Opcode ID: f712b919f3b63f25bfbceb0413b62d18fa3dc171ee0db86907f1ff86ecfe1596
                                                                                            • Instruction ID: 2294e9cbb954cb5d11e6db918260f243532ccddadd15b3293a720a1a7f2147f0
                                                                                            • Opcode Fuzzy Hash: f712b919f3b63f25bfbceb0413b62d18fa3dc171ee0db86907f1ff86ecfe1596
                                                                                            • Instruction Fuzzy Hash: CB01DE36815208BBDB217BA5DC09BAE7B6AEF82730F244219F925D61E0CB70C911C7B0
                                                                                            Function 00DF9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D79BB2
                                                                                            • GetClientRect.USER32(?,?), ref: 00DF9F31
                                                                                            • GetCursorPos.USER32(?), ref: 00DF9F3B
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF9F46
                                                                                            • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00DF9F7A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Client$CursorLongProcRectScreenWindow
                                                                                            • String ID:
                                                                                            • API String ID: 4127811313-0
                                                                                            • Opcode ID: 9a061aca9aa02ae44e6fd29f5fa24efa4641b31a6fb49123f79f545fc00ebc0f
                                                                                            • Instruction ID: 261dee317f416c69ea1b018d594bf48c5ed2a3254857caffcaa4b2073e83c935
                                                                                            • Opcode Fuzzy Hash: 9a061aca9aa02ae44e6fd29f5fa24efa4641b31a6fb49123f79f545fc00ebc0f
                                                                                            • Instruction Fuzzy Hash: 3311363290021EABDB00DF68D899AFEBBB8EF45311F058455FA01E7250D730BA95CBB1
                                                                                            Function 00D6600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D6604C
                                                                                            • GetStockObject.GDI32(00000011), ref: 00D66060
                                                                                            • SendMessageW.USER32(00000000,00000030,00000000), ref: 00D6606A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CreateMessageObjectSendStockWindow
                                                                                            • String ID:
                                                                                            • API String ID: 3970641297-0
                                                                                            • Opcode ID: 8193f042b445851197d3c786da5224f80585a72aefdccc924591b977c671b3a1
                                                                                            • Instruction ID: 423d03ac612d29a5dc7bd46f9b0d2c212c7d7aef4af7a7f3857184edcfee8e2e
                                                                                            • Opcode Fuzzy Hash: 8193f042b445851197d3c786da5224f80585a72aefdccc924591b977c671b3a1
                                                                                            • Instruction Fuzzy Hash: 31115B72501608BFEF129FA49C44AEABF69EF093A4F044225FA1592120D732DC60DBB0
                                                                                            Function 00D83B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ___BuildCatchObject.LIBVCRUNTIME ref: 00D83B56
                                                                                              • Part of subcall function 00D83AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00D83AD2
                                                                                              • Part of subcall function 00D83AA3: ___AdjustPointer.LIBCMT ref: 00D83AED
                                                                                            • _UnwindNestedFrames.LIBCMT ref: 00D83B6B
                                                                                            • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00D83B7C
                                                                                            • CallCatchBlock.LIBVCRUNTIME ref: 00D83BA4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                            • String ID:
                                                                                            • API String ID: 737400349-0
                                                                                            • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                            • Instruction ID: 18544dd89548f6dd94c07b0f4f9f207e852e1313fddcd7fa0c9b727368b933b7
                                                                                            • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                                            • Instruction Fuzzy Hash: AE01E572100149BBDF126E95CC46EEB7F6AEF98B54F054018FE48A6121D732E961EBB0
                                                                                            Function 00D93073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D613C6,00000000,00000000,?,00D9301A,00D613C6,00000000,00000000,00000000,?,00D9328B,00000006,FlsSetValue), ref: 00D930A5
                                                                                            • GetLastError.KERNEL32(?,00D9301A,00D613C6,00000000,00000000,00000000,?,00D9328B,00000006,FlsSetValue,00E02290,FlsSetValue,00000000,00000364,?,00D92E46), ref: 00D930B1
                                                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D9301A,00D613C6,00000000,00000000,00000000,?,00D9328B,00000006,FlsSetValue,00E02290,FlsSetValue,00000000), ref: 00D930BF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LibraryLoad$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 3177248105-0
                                                                                            • Opcode ID: c8d203530d4f2d557a267a300e12401be2cef7028a22ffdd0bf41666014dad02
                                                                                            • Instruction ID: d4cbe1529c3239fa2f7056823c84c185145bc5ae43b1394c29d85db12d27f7c1
                                                                                            • Opcode Fuzzy Hash: c8d203530d4f2d557a267a300e12401be2cef7028a22ffdd0bf41666014dad02
                                                                                            • Instruction Fuzzy Hash: 9501F732311326ABCF314F79AC44A677B98AF05BA1B154720F919E7280C721DD15C6F0
                                                                                            Function 00DC7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00DC747F
                                                                                            • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00DC7497
                                                                                            • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00DC74AC
                                                                                            • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00DC74CA
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Type$Register$FileLoadModuleNameUser
                                                                                            • String ID:
                                                                                            • API String ID: 1352324309-0
                                                                                            • Opcode ID: 4ac205a2cbe884598e2b3b53d71a817c6c0ab9c3d35831e4b0998d4e3c576a19
                                                                                            • Instruction ID: 422b005f0d225b8e29536958bb3fe7668fb5ac5b0118fc7c929f4072849627cd
                                                                                            • Opcode Fuzzy Hash: 4ac205a2cbe884598e2b3b53d71a817c6c0ab9c3d35831e4b0998d4e3c576a19
                                                                                            • Instruction Fuzzy Hash: 2F118BB120931AABE7208F14DD09FA2BBFCEB00B00F10856DAA66D7191D7B0E904DF70
                                                                                            Function 00DCB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DCACD3,?,00008000), ref: 00DCB0C4
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DCACD3,?,00008000), ref: 00DCB0E9
                                                                                            • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DCACD3,?,00008000), ref: 00DCB0F3
                                                                                            • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DCACD3,?,00008000), ref: 00DCB126
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CounterPerformanceQuerySleep
                                                                                            • String ID:
                                                                                            • API String ID: 2875609808-0
                                                                                            • Opcode ID: 7bec13c9e9937c02ef9878e5d9e31e8bb7bfa6e8305c1aea7aaad8a50f603eb2
                                                                                            • Instruction ID: bf80afe5d74907d01a0ea2048909c24398f8669e5d147c84a64191f263e8c613
                                                                                            • Opcode Fuzzy Hash: 7bec13c9e9937c02ef9878e5d9e31e8bb7bfa6e8305c1aea7aaad8a50f603eb2
                                                                                            • Instruction Fuzzy Hash: 47112E31D0161DD7CF009FA4E959BEEBB74FF09721F14408AD541B3241CB309560CB62
                                                                                            Function 00DF7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowRect.USER32(?,?), ref: 00DF7E33
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF7E4B
                                                                                            • ScreenToClient.USER32(?,?), ref: 00DF7E6F
                                                                                            • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DF7E8A
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClientRectScreen$InvalidateWindow
                                                                                            • String ID:
                                                                                            • API String ID: 357397906-0
                                                                                            • Opcode ID: 1331e24dd678d61ebed87d238f416493c1d2845a5e00d055d6c3e6347f51c7e0
                                                                                            • Instruction ID: 88ffe08ab304d4ec900765eb300971cb1a0363e526ac99cffadff0c63837450c
                                                                                            • Opcode Fuzzy Hash: 1331e24dd678d61ebed87d238f416493c1d2845a5e00d055d6c3e6347f51c7e0
                                                                                            • Instruction Fuzzy Hash: 311143B9D0420EAFDB41DF98C9849EEBBF5FB08310F509056E915E2210D735AA65CF60
                                                                                            Function 00DC2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DC2DC5
                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 00DC2DD6
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 00DC2DDD
                                                                                            • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DC2DE4
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2710830443-0
                                                                                            • Opcode ID: 7d624852958dffb9b76a7703508502069a55efb71d0d1d9e217a22cccdf91eca
                                                                                            • Instruction ID: e2ea062d239b6526aaeb962d55ec37e6521c30eafac8410696f0f15e9a181767
                                                                                            • Opcode Fuzzy Hash: 7d624852958dffb9b76a7703508502069a55efb71d0d1d9e217a22cccdf91eca
                                                                                            • Instruction Fuzzy Hash: 49E092712153287BD7201B72AD0DFFB3E6CEF53BA1F045019F106D21909AA4C840C6F0
                                                                                            Function 00DF8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D79693
                                                                                              • Part of subcall function 00D79639: SelectObject.GDI32(?,00000000), ref: 00D796A2
                                                                                              • Part of subcall function 00D79639: BeginPath.GDI32(?), ref: 00D796B9
                                                                                              • Part of subcall function 00D79639: SelectObject.GDI32(?,00000000), ref: 00D796E2
                                                                                            • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00DF8887
                                                                                            • LineTo.GDI32(?,?,?), ref: 00DF8894
                                                                                            • EndPath.GDI32(?), ref: 00DF88A4
                                                                                            • StrokePath.GDI32(?), ref: 00DF88B2
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                            • String ID:
                                                                                            • API String ID: 1539411459-0
                                                                                            • Opcode ID: 09339e7ba02980b32b8ba36978c225dcadf6e720f022f8bdd1fdee98e69edc6b
                                                                                            • Instruction ID: da5245de16c29bfa9509b426001f33d9f771fb358e1cf9b7711abe4039a9adb5
                                                                                            • Opcode Fuzzy Hash: 09339e7ba02980b32b8ba36978c225dcadf6e720f022f8bdd1fdee98e69edc6b
                                                                                            • Instruction Fuzzy Hash: 45F03A3604125DBADB125F94AD0DFEE3E59AF06350F04C140FA11A51E1CB755521DBF5
                                                                                            Function 00D798B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetSysColor.USER32(00000008), ref: 00D798CC
                                                                                            • SetTextColor.GDI32(?,?), ref: 00D798D6
                                                                                            • SetBkMode.GDI32(?,00000001), ref: 00D798E9
                                                                                            • GetStockObject.GDI32(00000005), ref: 00D798F1
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Color$ModeObjectStockText
                                                                                            • String ID:
                                                                                            • API String ID: 4037423528-0
                                                                                            • Opcode ID: 60fb92fbdfeec9f055574f285671eb043c8af00d27685da99114055306922494
                                                                                            • Instruction ID: b9eb12493617c6772c22f76da23cd18be3a9e74cf7d0308e242d6a75b4e80400
                                                                                            • Opcode Fuzzy Hash: 60fb92fbdfeec9f055574f285671eb043c8af00d27685da99114055306922494
                                                                                            • Instruction Fuzzy Hash: BCE03031254744AADB215B74AD09BE83B50AB51336F18D219F6BA982E1C3714660DB30
                                                                                            Function 00DC162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetCurrentThread.KERNEL32 ref: 00DC1634
                                                                                            • OpenThreadToken.ADVAPI32(00000000,?,?,?,00DC11D9), ref: 00DC163B
                                                                                            • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00DC11D9), ref: 00DC1648
                                                                                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,00DC11D9), ref: 00DC164F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CurrentOpenProcessThreadToken
                                                                                            • String ID:
                                                                                            • API String ID: 3974789173-0
                                                                                            • Opcode ID: edeaa9f60a3d97f5280ac41eb3f30285ee60f0e6400342b0c15f2c356d923f1f
                                                                                            • Instruction ID: f9729c7d3868aa3677a08ce6dcb1b2ab76a6f56fc327c1996f1b73adb379ae25
                                                                                            • Opcode Fuzzy Hash: edeaa9f60a3d97f5280ac41eb3f30285ee60f0e6400342b0c15f2c356d923f1f
                                                                                            • Instruction Fuzzy Hash: C2E04F366513259BD7201BB09E0DF663B68AF45791F188808F245CA080DA244495C774
                                                                                            Function 00DBD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDesktopWindow.USER32 ref: 00DBD858
                                                                                            • GetDC.USER32(00000000), ref: 00DBD862
                                                                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DBD882
                                                                                            • ReleaseDC.USER32(?), ref: 00DBD8A3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2889604237-0
                                                                                            • Opcode ID: ba1f5866b2ab4cded315bd294274d685c57124497a3f69e51f0e489414b407ba
                                                                                            • Instruction ID: 44cfa6a572702692896be1ea7c15f9ecd03bee7af3f77d05cd1a8a8423f88e81
                                                                                            • Opcode Fuzzy Hash: ba1f5866b2ab4cded315bd294274d685c57124497a3f69e51f0e489414b407ba
                                                                                            • Instruction Fuzzy Hash: 0FE0E5B4814208DFCB419FA09A08A7DBBB2EB08311B10E409E846E7360DB388951EF60
                                                                                            Function 00DBD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetDesktopWindow.USER32 ref: 00DBD86C
                                                                                            • GetDC.USER32(00000000), ref: 00DBD876
                                                                                            • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DBD882
                                                                                            • ReleaseDC.USER32(?), ref: 00DBD8A3
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                                                            • String ID:
                                                                                            • API String ID: 2889604237-0
                                                                                            • Opcode ID: 03ded51ac0ec3a601d77f88d07e9849101327f1d8ff84349bfda77ecebd777e1
                                                                                            • Instruction ID: ff4611f2a410ce926c5694caca0bd65d840e33d575d476054138bcdcb06806d8
                                                                                            • Opcode Fuzzy Hash: 03ded51ac0ec3a601d77f88d07e9849101327f1d8ff84349bfda77ecebd777e1
                                                                                            • Instruction Fuzzy Hash: 21E0E570814208DFCB409FA0990866DBBB1AB08310B10A408E84AE7360DB385951DF60
                                                                                            Function 00DD4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D67620: _wcslen.LIBCMT ref: 00D67625
                                                                                            • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00DD4ED4
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Connection_wcslen
                                                                                            • String ID: *$LPT
                                                                                            • API String ID: 1725874428-3443410124
                                                                                            • Opcode ID: 20f27e6c4516d8469a39d59cf7dd70fb2c187477da9ddf30e6f41b9e7489fdec
                                                                                            • Instruction ID: 4c9762205ce3b7cc4f0d81b0099569cc51d5bbe398dc2a9b1752b67c87f3d598
                                                                                            • Opcode Fuzzy Hash: 20f27e6c4516d8469a39d59cf7dd70fb2c187477da9ddf30e6f41b9e7489fdec
                                                                                            • Instruction Fuzzy Hash: 99914F75A002449FCB14DF58C484EAABBF5EF44304F19809AE44A9F362D731ED85CBB1
                                                                                            Function 00D8E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __startOneArgErrorHandling.LIBCMT ref: 00D8E30D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ErrorHandling__start
                                                                                            • String ID: pow
                                                                                            • API String ID: 3213639722-2276729525
                                                                                            • Opcode ID: c110bfc82181cdaaa4cf05cf2a13a314cb8d6978e7484d0055baf1db5590a893
                                                                                            • Instruction ID: ad3a20c9c1a674dcefef8be4a2155b604ce87348908afd4a2f5a72a4a8b10991
                                                                                            • Opcode Fuzzy Hash: c110bfc82181cdaaa4cf05cf2a13a314cb8d6978e7484d0055baf1db5590a893
                                                                                            • Instruction Fuzzy Hash: C4512B61A2C202D6CF157718C9057B93BA4EF40B41F384A98F0D5922E9DB35CCD59FB6
                                                                                            Function 00DE7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CharUpperBuffW.USER32(00DB569E,00000000,?,00DFCC08,?,00000000,00000000), ref: 00DE78DD
                                                                                              • Part of subcall function 00D66B57: _wcslen.LIBCMT ref: 00D66B6A
                                                                                            • CharUpperBuffW.USER32(00DB569E,00000000,?,00DFCC08,00000000,?,00000000,00000000), ref: 00DE783B
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharUpper$_wcslen
                                                                                            • String ID: <s
                                                                                            • API String ID: 3544283678-2940880691
                                                                                            • Opcode ID: acfcbb2c680792c06d6d5bfbd482283a39cf517582149f29aee14ec6d25afb3a
                                                                                            • Instruction ID: 0f5664b36280de0d7b8536110e0cafdc87604010aa439f34ffb7ce1ecda97405
                                                                                            • Opcode Fuzzy Hash: acfcbb2c680792c06d6d5bfbd482283a39cf517582149f29aee14ec6d25afb3a
                                                                                            • Instruction Fuzzy Hash: 30613B32914158ABCF44FBA5CC91DFDB378FF24304B54512AE542B3192EF20AA09DBB0
                                                                                            Function 00D7E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: #
                                                                                            • API String ID: 0-1885708031
                                                                                            • Opcode ID: 9c23df9f6f3622307d306db5b819a9659280cd85935a5b5fe0340af110342c55
                                                                                            • Instruction ID: b1fec9f2a748ebf8fc345fa5333ce113912833fa198af51f84b8183bd32bcfd9
                                                                                            • Opcode Fuzzy Hash: 9c23df9f6f3622307d306db5b819a9659280cd85935a5b5fe0340af110342c55
                                                                                            • Instruction Fuzzy Hash: 8C512675504346EFDB15DF68C4416FA7BA4EF59310F288095EC929B2D1EA30DD42DBB0
                                                                                            Function 00D7F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • Sleep.KERNEL32(00000000), ref: 00D7F2A2
                                                                                            • GlobalMemoryStatusEx.KERNEL32(?), ref: 00D7F2BB
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: GlobalMemorySleepStatus
                                                                                            • String ID: @
                                                                                            • API String ID: 2783356886-2766056989
                                                                                            • Opcode ID: edc5f35d3109fd389da18f5b72b2e8c38303a5f204f720be4f9736ec7b7bfd9c
                                                                                            • Instruction ID: f10e37be142a1a702f193e9e20c68733d4ccdd8908c47da605a86a80905a248b
                                                                                            • Opcode Fuzzy Hash: edc5f35d3109fd389da18f5b72b2e8c38303a5f204f720be4f9736ec7b7bfd9c
                                                                                            • Instruction Fuzzy Hash: 585155714187899BD320AF50D886BABBBF8FF84304F81884DF2D9411A5EB718529CB76
                                                                                            Function 00DE5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00DE57E0
                                                                                            • _wcslen.LIBCMT ref: 00DE57EC
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: BuffCharUpper_wcslen
                                                                                            • String ID: CALLARGARRAY
                                                                                            • API String ID: 157775604-1150593374
                                                                                            • Opcode ID: 0fe34dec6a67cd54bd151edb8bb47f0623b8cd13e44de90cf861b17c60a304fa
                                                                                            • Instruction ID: 253b34b7864a2a3ed943f418063db66e188da9e60753e4a338deeaf1d1d5b619
                                                                                            • Opcode Fuzzy Hash: 0fe34dec6a67cd54bd151edb8bb47f0623b8cd13e44de90cf861b17c60a304fa
                                                                                            • Instruction Fuzzy Hash: 6441A231E001099FCB14EFA9D8819BEBBB5FF59358F148169E505A7255E7309D81CBB0
                                                                                            Function 00DDD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • _wcslen.LIBCMT ref: 00DDD130
                                                                                            • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00DDD13A
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CrackInternet_wcslen
                                                                                            • String ID: |
                                                                                            • API String ID: 596671847-2343686810
                                                                                            • Opcode ID: 06d661ebf8efa01f440c4bccee4bc2c7acca59b5f381fd79bc0811670d2190cc
                                                                                            • Instruction ID: 032c47c52f646cdba0f5b4c7fed05303c6db460a70cc23f0185667fee5f7a67a
                                                                                            • Opcode Fuzzy Hash: 06d661ebf8efa01f440c4bccee4bc2c7acca59b5f381fd79bc0811670d2190cc
                                                                                            • Instruction Fuzzy Hash: A0311E71D00219ABCF15EFA4CC85AEEBFBAFF14300F104119F815A6266D731AA56DBB0
                                                                                            Function 00DF356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DestroyWindow.USER32(?,?,?,?), ref: 00DF3621
                                                                                            • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00DF365C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$DestroyMove
                                                                                            • String ID: static
                                                                                            • API String ID: 2139405536-2160076837
                                                                                            • Opcode ID: 8f56724527eff69e7bfcca86cbe8bba68c22c5cd7dfc7f253fa6888217ae4e88
                                                                                            • Instruction ID: 539a62f1b1bab8db7dd0c88553617c8f69870e1e35769208a42fea6a45b118ae
                                                                                            • Opcode Fuzzy Hash: 8f56724527eff69e7bfcca86cbe8bba68c22c5cd7dfc7f253fa6888217ae4e88
                                                                                            • Instruction Fuzzy Hash: 04318B71110208AEDB149F68DC80EBB73A9FF88724F06D619FAA5D7290DA30ED91D770
                                                                                            Function 00DF4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00DF461F
                                                                                            • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DF4634
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: '
                                                                                            • API String ID: 3850602802-1997036262
                                                                                            • Opcode ID: 8e4d2350f58abb69ac215e765af1db89e97bf9fcca757684e307ffd019190d0f
                                                                                            • Instruction ID: 81dd98e3022e88c431072c9f5dd90e2d77ef4a158ed7b81b8a73a85584cf2d12
                                                                                            • Opcode Fuzzy Hash: 8e4d2350f58abb69ac215e765af1db89e97bf9fcca757684e307ffd019190d0f
                                                                                            • Instruction Fuzzy Hash: C0310774A0120D9FDB14DFA9C990BEA7BB5FF49300F15806AEA05EB391D770A945CFA0
                                                                                            Function 00DF31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DF327C
                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DF3287
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: MessageSend
                                                                                            • String ID: Combobox
                                                                                            • API String ID: 3850602802-2096851135
                                                                                            • Opcode ID: 61dc8a39158173c5090ce79f94aff16bf11f3096aacde1e4d6ec50c9ef8ecd94
                                                                                            • Instruction ID: 8d80d07a8abae75c13dc1accc90bae9f25302bd469646bfdbaca24170391ee7b
                                                                                            • Opcode Fuzzy Hash: 61dc8a39158173c5090ce79f94aff16bf11f3096aacde1e4d6ec50c9ef8ecd94
                                                                                            • Instruction Fuzzy Hash: 1611B27130020C7FFF259E54DC84EBB3B6AEB94364F168129FA18A7290D631DD519774
                                                                                            Function 00DF3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D6604C
                                                                                              • Part of subcall function 00D6600E: GetStockObject.GDI32(00000011), ref: 00D66060
                                                                                              • Part of subcall function 00D6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D6606A
                                                                                            • GetWindowRect.USER32(00000000,?), ref: 00DF377A
                                                                                            • GetSysColor.USER32(00000012), ref: 00DF3794
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                            • String ID: static
                                                                                            • API String ID: 1983116058-2160076837
                                                                                            • Opcode ID: cdb3be31076eea16135ab2146914173c63923846ddaddfc0e27fc3d409f90f95
                                                                                            • Instruction ID: 31f1ea487f6c1ce21edc05d5a9aae93603eb5f99e82ec261025e8afa2d0ad4cf
                                                                                            • Opcode Fuzzy Hash: cdb3be31076eea16135ab2146914173c63923846ddaddfc0e27fc3d409f90f95
                                                                                            • Instruction Fuzzy Hash: 5F1129B261020DAFDB00EFA8CC45AFA7BB8EB08314F029914FA55E2250D775E865DB60
                                                                                            Function 00DDCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00DDCD7D
                                                                                            • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00DDCDA6
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Internet$OpenOption
                                                                                            • String ID: <local>
                                                                                            • API String ID: 942729171-4266983199
                                                                                            • Opcode ID: b4399d7689b8b9c6f8ee6568311fdbce3cd2a49560f2032af8985d2faeb71ee7
                                                                                            • Instruction ID: c67a84171747befd07e4e8441b5f79b371d61b8e22964ad1bbd83dd53285f3dd
                                                                                            • Opcode Fuzzy Hash: b4399d7689b8b9c6f8ee6568311fdbce3cd2a49560f2032af8985d2faeb71ee7
                                                                                            • Instruction Fuzzy Hash: EE11C6712256367AD7384B668C45EF7BE6EEF127A4F005227B149D3280D7709941D6F0
                                                                                            Function 00DF3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetWindowTextLengthW.USER32(00000000), ref: 00DF34AB
                                                                                            • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00DF34BA
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LengthMessageSendTextWindow
                                                                                            • String ID: edit
                                                                                            • API String ID: 2978978980-2167791130
                                                                                            • Opcode ID: 18148c427205c58866dd6ae73969597e295db749d12135ff733867c3cfc792a3
                                                                                            • Instruction ID: 91edb5b7589336935c519d389c8c374865bb6d525f83bd1760957ee0618e62a7
                                                                                            • Opcode Fuzzy Hash: 18148c427205c58866dd6ae73969597e295db749d12135ff733867c3cfc792a3
                                                                                            • Instruction Fuzzy Hash: 0C118F7110020CAFEB118E64DC44ABB376AEB05374F568724FA61D72E0C771DD619B70
                                                                                            Function 00DC6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                            • CharUpperBuffW.USER32(?,?,?), ref: 00DC6CB6
                                                                                            • _wcslen.LIBCMT ref: 00DC6CC2
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen$BuffCharUpper
                                                                                            • String ID: STOP
                                                                                            • API String ID: 1256254125-2411985666
                                                                                            • Opcode ID: 95111a2248661966d27213cf26d57712851344105001d6dda25c4b03baab7e0d
                                                                                            • Instruction ID: eb038b72e40e04f0f465835527b0a7f8002cd743f41665d9ce2348f731247cd6
                                                                                            • Opcode Fuzzy Hash: 95111a2248661966d27213cf26d57712851344105001d6dda25c4b03baab7e0d
                                                                                            • Instruction Fuzzy Hash: 0001C4326105278BCB20AFBDDD91EBF77A5EA61720715052CE86297195EB31D940C670
                                                                                            Function 00DC1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00DC1D4C
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 624084870-1403004172
                                                                                            • Opcode ID: 8d4c876f3d669a1736d2d81440448a68918883f4fc1d7de7ead267ab25d4424c
                                                                                            • Instruction ID: b775b8dddde537582d14fde6298318ea04c271925d98a79ee34cd4f8fb5781d1
                                                                                            • Opcode Fuzzy Hash: 8d4c876f3d669a1736d2d81440448a68918883f4fc1d7de7ead267ab25d4424c
                                                                                            • Instruction Fuzzy Hash: 9301D875601229ABCB14EBA4CE51EFEB368EB57350B14091DF863673D2EA309918C670
                                                                                            Function 00DC1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,00000180,00000000,?), ref: 00DC1C46
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 624084870-1403004172
                                                                                            • Opcode ID: 774c4b89a4de9f0f004dc63c46c7ed816da5a1ffb9f6c2144dc3fcdc61b2032b
                                                                                            • Instruction ID: 278064a6c85112afba0f392c914942a154180509931c18e5a3ce4415aac36ea0
                                                                                            • Opcode Fuzzy Hash: 774c4b89a4de9f0f004dc63c46c7ed816da5a1ffb9f6c2144dc3fcdc61b2032b
                                                                                            • Instruction Fuzzy Hash: 9101A77568121967CB14EB90CB61FFFB7ACDB12340F14001DB40677282EA349E18E6B1
                                                                                            Function 00DC1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,00000182,?,00000000), ref: 00DC1CC8
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 624084870-1403004172
                                                                                            • Opcode ID: b29e69c256f1e3e531519b2a20949a3f6a58c2aa5a8d8fd77025490799b4fcba
                                                                                            • Instruction ID: d350cd1aea115cdbde7d1ac88047b9a5f906c59365d4df80f00e2f6af3ecf1d5
                                                                                            • Opcode Fuzzy Hash: b29e69c256f1e3e531519b2a20949a3f6a58c2aa5a8d8fd77025490799b4fcba
                                                                                            • Instruction Fuzzy Hash: 890186B568122967CB14FBA5CB51FFEF7ACDB12340F140019B842B3282EA719F19D671
                                                                                            Function 00DC1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D69CB3: _wcslen.LIBCMT ref: 00D69CBD
                                                                                              • Part of subcall function 00DC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DC3CCA
                                                                                            • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00DC1DD3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ClassMessageNameSend_wcslen
                                                                                            • String ID: ComboBox$ListBox
                                                                                            • API String ID: 624084870-1403004172
                                                                                            • Opcode ID: 61810d21e4bf0837f9c4770abb3040ed6a9be07620fd957e1fa1a6230e7782ef
                                                                                            • Instruction ID: f0845498e442cb9b3f99291f6106a6b238e86097c153f324433ca2c5fe30135a
                                                                                            • Opcode Fuzzy Hash: 61810d21e4bf0837f9c4770abb3040ed6a9be07620fd957e1fa1a6230e7782ef
                                                                                            • Instruction Fuzzy Hash: 96F0A475A4132A67DB14F7A4DE62FFEB76CEB12350F140919B862A32C2DA7099188270
                                                                                            Function 00DF8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E33018,00E3305C), ref: 00DF81BF
                                                                                            • CloseHandle.KERNEL32 ref: 00DF81D1
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CloseCreateHandleProcess
                                                                                            • String ID: \0
                                                                                            • API String ID: 3712363035-3218720685
                                                                                            • Opcode ID: f40b5d7bd529df1dc0d7cac35899974e5af292f8d8deff00962dd24a86c447eb
                                                                                            • Instruction ID: 6cd46676588ba617a1b227ebc3cfc2e1a46e59253920162731fdbcc96cb56a86
                                                                                            • Opcode Fuzzy Hash: f40b5d7bd529df1dc0d7cac35899974e5af292f8d8deff00962dd24a86c447eb
                                                                                            • Instruction Fuzzy Hash: 90F082B1A40308BEF3246772AC4AFB73E9CDB05751F004424BB08E51A2D6798E18DBF8
                                                                                            Function 00DE747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: _wcslen
                                                                                            • String ID: 3, 3, 16, 1
                                                                                            • API String ID: 176396367-3042988571
                                                                                            • Opcode ID: c529503b3e520f1f6c264a91b73a130379b092cf46dabce898ce94b300390662
                                                                                            • Instruction ID: 405074ff6f4ab2369a503e606f2a4e03b6c26b634859fe32fc42143dd5cd0d41
                                                                                            • Opcode Fuzzy Hash: c529503b3e520f1f6c264a91b73a130379b092cf46dabce898ce94b300390662
                                                                                            • Instruction Fuzzy Hash: CDE06102305361109371327BECC197F5689CFC9760718182FF989C22E6EB94CD9193B0
                                                                                            Function 00DC0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00DC0B23
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Message
                                                                                            • String ID: AutoIt$Error allocating memory.
                                                                                            • API String ID: 2030045667-4017498283
                                                                                            • Opcode ID: 0f38525d3fff58cfb5fcb219766b9b42389878b6f4e96b97c6d691a3f4052cb4
                                                                                            • Instruction ID: 9232886989080de815e3c9eb93bb65bbfd6cf9f7b76b65361b8c00f028bb4551
                                                                                            • Opcode Fuzzy Hash: 0f38525d3fff58cfb5fcb219766b9b42389878b6f4e96b97c6d691a3f4052cb4
                                                                                            • Instruction Fuzzy Hash: C4E0D83228431C2AD22037547D03F997A84CF05B11F10842AFB58955C39AE164A046F9
                                                                                            Function 00D80D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 00D7F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00D80D71,?,?,?,00D6100A), ref: 00D7F7CE
                                                                                            • IsDebuggerPresent.KERNEL32(?,?,?,00D6100A), ref: 00D80D75
                                                                                            • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D6100A), ref: 00D80D84
                                                                                            Strings
                                                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D80D7F
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                            • API String ID: 55579361-631824599
                                                                                            • Opcode ID: 6949c9c2fcde467f9f53c235d855a1571d582f70c25f9370796f5a941c59b551
                                                                                            • Instruction ID: 7cd4cc9958ac26426dc6fb8dc778a04af9007404e85c78750288085e8eaca432
                                                                                            • Opcode Fuzzy Hash: 6949c9c2fcde467f9f53c235d855a1571d582f70c25f9370796f5a941c59b551
                                                                                            • Instruction Fuzzy Hash: 6DE039702003018FD360AFA9D5083627FE4EF00740F05892DE486C6B51EBB0E448CBB1
                                                                                            Function 00D7E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • __Init_thread_footer.LIBCMT ref: 00D7E3D5
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Init_thread_footer
                                                                                            • String ID: 0%$8%
                                                                                            • API String ID: 1385522511-2949748613
                                                                                            • Opcode ID: 21f786456c9c89d0b218d91d13d0b6f27d0c281d951e9e7cfdc3ac9b95403850
                                                                                            • Instruction ID: a20a6426e773bf57a428afb025237ca6fb8bc003ed946f898d7716e29e224262
                                                                                            • Opcode Fuzzy Hash: 21f786456c9c89d0b218d91d13d0b6f27d0c281d951e9e7cfdc3ac9b95403850
                                                                                            • Instruction Fuzzy Hash: 9FE02632400A14EFC604E719B85DF883B51EB4D321B10D1ECE3C6A71D1AB302A45C77A
                                                                                            Function 00DD3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00DD302F
                                                                                            • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00DD3044
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: Temp$FileNamePath
                                                                                            • String ID: aut
                                                                                            • API String ID: 3285503233-3010740371
                                                                                            • Opcode ID: b3bf68b355420ae31528b5b5e582f86eb3ea211bb2a3d639dc06042438dae4f2
                                                                                            • Instruction ID: e2d428ce019d8193ba4c6e4fb0488f43228622a7bcc739e32d5355ccb0dae69b
                                                                                            • Opcode Fuzzy Hash: b3bf68b355420ae31528b5b5e582f86eb3ea211bb2a3d639dc06042438dae4f2
                                                                                            • Instruction Fuzzy Hash: 37D05EB250032CA7DA20A7A4AD0EFDB3A6CDB05750F0002A1B655E2192DAB09A84CAE4
                                                                                            Function 00DBD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: LocalTime
                                                                                            • String ID: %.3d$X64
                                                                                            • API String ID: 481472006-1077770165
                                                                                            • Opcode ID: 52ceddd2cc006f6507f7f46b405e665cda4ab6f00a8572aa46a8b6bdeae3bf23
                                                                                            • Instruction ID: 8c1303cd322c01ffeea2b8b332cf9fb3bbe292b0c87e81cac7d2bd0d01e5a823
                                                                                            • Opcode Fuzzy Hash: 52ceddd2cc006f6507f7f46b405e665cda4ab6f00a8572aa46a8b6bdeae3bf23
                                                                                            • Instruction Fuzzy Hash: AFD01261C09258E9CB5097D0DC458F9B37DFB08301F50C462F99BE1040F634C908AB75
                                                                                            Function 00DF2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DF236C
                                                                                            • PostMessageW.USER32(00000000), ref: 00DF2373
                                                                                              • Part of subcall function 00DCE97B: Sleep.KERNEL32 ref: 00DCE9F3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FindMessagePostSleepWindow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 529655941-2988720461
                                                                                            • Opcode ID: 733f71c9e679b951a3f4812de05d780feccf46e1a12fba2b905f3e303fcb8629
                                                                                            • Instruction ID: de59c0d4ea2a6d0404b384884d7a047b82a68150ac3f51e9ff55d68aeaa7da21
                                                                                            • Opcode Fuzzy Hash: 733f71c9e679b951a3f4812de05d780feccf46e1a12fba2b905f3e303fcb8629
                                                                                            • Instruction Fuzzy Hash: E9D0C9723953247BE664A770AD0FFD666149B05B14F009A167645EA2E0C9B0A821CA64
                                                                                            Function 00DF2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DF232C
                                                                                            • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00DF233F
                                                                                              • Part of subcall function 00DCE97B: Sleep.KERNEL32 ref: 00DCE9F3
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: FindMessagePostSleepWindow
                                                                                            • String ID: Shell_TrayWnd
                                                                                            • API String ID: 529655941-2988720461
                                                                                            • Opcode ID: 05187cfd9c0a8035fccc48c31b028faa6d998b613fb52efaf0b09dd4726fd65d
                                                                                            • Instruction ID: 8b602a85f555572ffacd5e1fc256e8b8e1eca93e73bca0482e9c6986bb8f3503
                                                                                            • Opcode Fuzzy Hash: 05187cfd9c0a8035fccc48c31b028faa6d998b613fb52efaf0b09dd4726fd65d
                                                                                            • Instruction Fuzzy Hash: 7FD012763A4324B7E664B770ED0FFD67A149B00B14F009A167745EA2E0C9F0A821CE74
                                                                                            Function 00D9BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00D9BE93
                                                                                            • GetLastError.KERNEL32 ref: 00D9BEA1
                                                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D9BEFC
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000000.00000002.1653012031.0000000000D61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true
                                                                                            • Associated: 00000000.00000002.1652995059.0000000000D60000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000DFC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653068951.0000000000E22000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653109178.0000000000E2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                            • Associated: 00000000.00000002.1653125471.0000000000E34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_0_2_d60000_file.jbxd
                                                                                            Similarity
                                                                                            • API ID: ByteCharMultiWide$ErrorLast
                                                                                            • String ID:
                                                                                            • API String ID: 1717984340-0
                                                                                            • Opcode ID: 86c94267997e45af2b0120bacb3fb8393f6e69df3634f66d0ee781d17edf8839
                                                                                            • Instruction ID: 5e26a3d6eedf58f1a6e2db03a738996e190022d093c2c41670d9a9fae67654b2
                                                                                            • Opcode Fuzzy Hash: 86c94267997e45af2b0120bacb3fb8393f6e69df3634f66d0ee781d17edf8839
                                                                                            • Instruction Fuzzy Hash: AD41FC34604206EFCF219FA4EE44ABA7BB9EF41330F1A415AF959971A1DB318D00CB70

                                                                                            Execution Graph

                                                                                            Execution Coverage:0.5%
                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                            Signature Coverage:100%
                                                                                            Total number of Nodes:6
                                                                                            Total number of Limit Nodes:0
                                                                                            execution_graph 5014 1c06db28ab7 5015 1c06db28ac7 NtQuerySystemInformation 5014->5015 5016 1c06db28a64 5015->5016 5017 1c06db59c72 5018 1c06db59cc9 NtQuerySystemInformation 5017->5018 5019 1c06db58044 5017->5019 5018->5019

                                                                                            Callgraph

                                                                                            Executed Functions

                                                                                            Function 000001C06DB59C72 Relevance: 26.1, APIs: 1, Strings: 10, Instructions: 6826nativeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000010.00000002.2917348600.000001C06DB57000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001C06DB57000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_16_2_1c06db57000_firefox.jbxd
                                                                                            Similarity
                                                                                            • API ID: InformationQuerySystem
                                                                                            • String ID: #$#$#$4$>$>$>$A$z$z
                                                                                            • API String ID: 3562636166-3072146587
                                                                                            • Opcode ID: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                                            • Instruction ID: af503185fdc143ec6d8d35f24bd4576e8b0cb6719a48429bc40705f17d11ebbd
                                                                                            • Opcode Fuzzy Hash: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                                            • Instruction Fuzzy Hash: 8BA3E531618B59CBEB2EDF28DC856E973E5FB98300F14422ED84AC7255DE34E9528BC1